> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omegas.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create session

> Mint a live-view session for a device (201).



## OpenAPI

````yaml /schemas/operator.json post /v1/devices/{id}/sessions
openapi: 3.1.0
info:
  title: Omegas Operator API
  version: 0.1.0
  description: >-
    The public /v1 machine surface: cloud browser devices, tasks, live-view
    sessions, escalations, usage, webhook endpoints, and the audit trail.
    Generated from the same OpenAPI document the Rust API is checked against.
servers:
  - url: https://api.omegas.dev
    description: Production
security: []
paths:
  /v1/devices/{id}/sessions:
    post:
      tags:
        - Endpoints
      summary: Create session
      description: Mint a live-view session for a device (201).
      operationId: create_session
      parameters:
        - name: id
          in: path
          description: Device id (`dev_<uuid>`)
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSessionBody'
        required: true
      responses:
        '201':
          description: The minted session (token shown once)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedSession'
        '400':
          description: invalid mode
        '401':
          description: invalid_api_key
        '403':
          description: insufficient_scope or product_not_entitled
        '404':
          description: device_not_found
        '409':
          description: device_not_ready
        '410':
          description: device_terminated
        '429':
          description: rate_limited
      security:
        - bearer_operator: []
components:
  schemas:
    CreateSessionBody:
      type: object
      properties:
        mode:
          type:
            - string
            - 'null'
          description: >-
            `watch` (frames only) or `control` (frames + input + takeover).
            Defaults to `watch` — the

            less-privileged of the two, so an omitted field can never
            accidentally mint control.
        ttl_secs:
          type:
            - integer
            - 'null'
          format: int64
          description: >-
            Requested lifetime in seconds. Clamped to the server's allowed band;
            a client does not get to

            decide how long a live-browser capability lives.
    CreatedSession:
      type: object
      description: >-
        A minted session. `session_token` is returned EXACTLY ONCE — only its
        SHA-256 is stored.
      required:
        - id
        - object
        - device_id
        - mode
        - ws_url
        - session_token
        - expires_at
      properties:
        device_id:
          type: string
        expires_at:
          type: string
        id:
          type: string
          description: '`ses_<uuid>`.'
        mode:
          type: string
        object:
          type: string
          description: Discriminator for polymorphic SDK decoders. Always `"session"`.
        session_token:
          type: string
          description: Present only on the mint response.
        ws_url:
          type: string
          description: >-
            The BACKEND gateway to connect to. Never the sprite: the sprite's
            origin and viewer token stay

            inside the API process.
  securitySchemes:
    bearer_operator:
      type: http
      scheme: bearer
      bearerFormat: Opaque

````