Session — API reference

The dashboard session: the credential a browser holds, and the only one it ever holds. An API key is a machine credential and is never used from a page.

Signing in is one action for the person: the page fetches a challenge (POST /v1/accounts/challenge), the wallet signs it — free, no transaction, nothing leaves the wallet — and the signature comes to POST /v1/session, which sets an httpOnly cookie. The session survives reloads and navigation, slides forward as it is used, and is restored silently with GET /v1/session.

Because the credential is a cookie, every unsafe method additionally needs the X-CSRF-Token header, whose value is the csrf_token of the session response. A cross-site page cannot read that response, so it cannot produce the header.

Generated from openapi.yaml at build time. Base URL https://api.tenergy.me/v1, or https://api-nile.tenergy.me/v1 on Nile (Environments). Every request below is signed as in Authentication unless its Auth line says otherwise.

Restore the session silently

GET /v1/session · getSession

Auth: Dashboard session cookie + X-CSRF-Token.

What the dashboard calls on every load. Answers with the live session, or 1013 session_expired when the browser has none — which is not an error condition to report to the person, only the signal to show the sign-in screen.

Responses

Response fields (Session)

Sign in to the dashboard

POST /v1/session · createSession

Auth: Public — no credentials.

Verifies a challenge signed by a TRON address and opens a browser session, returned as an httpOnly cookie. If the address owns no account on this brand yet, one is created here — status: unfunded, the same account POST /v1/accounts would have made — so a first visit and a return visit are the same single action.

Signing the challenge is free and is not a transaction: no funds move and no key leaves the wallet.

The response body carries csrf_token. Send it as X-CSRF-Token on every subsequent POST, PATCH or DELETE made with this session.

Request body

JSON (SessionRequest), required.

Responses

Response fields (Session)

Sign out

DELETE /v1/session · deleteSession

Auth: Dashboard session cookie + X-CSRF-Token.

Revokes this session server-side and clears the cookie. Other sessions of the same account — another browser, another device — are untouched.

Responses

Extend the session

POST /v1/session/refresh · refreshSession

Auth: Dashboard session cookie + X-CSRF-Token.

Slides the expiry forward and reissues the cookie with a fresh lifetime. The session is also renewed automatically as it is used, so this is for a page that has been open a long time without making a request.

Responses

Response fields (Session)

Sign out everywhere

POST /v1/session/revoke-all · revokeAllSessions

Auth: Dashboard session cookie + X-CSRF-Token.

Revokes every session of the signed-in wallet on this account — every browser and device, this one included — and clears the cookie. Sessions of other members are not touched. Writes an audit row (session.revoke_all). Dashboard session only, member role viewer or above; every API key is refused.

Responses

Recent sign-ins

GET /v1/session/history · getSessionHistory

Auth: Dashboard session cookie + X-CSRF-Token.

The last ten dashboard sign-ins of the signed-in wallet on this account, newest first: when, from which IP, with which wallet. A sign-in is recorded when POST /v1/session issues a session; the history starts on 2026-09-25.

Sign-ins of other members are not listed: showing one member’s IP addresses to another is an access decision that has not been taken. Dashboard session only, member role viewer or above.

Responses

Response fields

Example 200 response, from the contract (illustrative values — live numbers come from the API):

{
  "data": [
    {
      "signed_in_at": "2026-09-25T09:41:12.000Z",
      "ip": "203.0.113.10",
      "address": "TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE"
    }
  ]
}