Session

This method will get the active Session Object

GET/api/sessions

Query parameters

`tokenIdentifiers`string	JWTs to return with sessionAllowed: `iw-externaliw-mqttiw-internalfirebaselanista`
`validSeconds`number	JWT valid for duration in seconds

Responses

200This method will get the active Session ObjectSession2

Show fields (16)

idinteger
Primary key of the session. Internal ID.
sessionidstring
ID of the session.
userUser4
User the session belongs to.
Show fields (12)
- idinteger
  Primary key of the user. Internal ID of the login user.
- namestring
  Display name of the user. Shown in the UI and in audit entries.
- usernamestring
  Login name of the user. Must be unique across all users.
- emailstring
  E-mail address of the user. Used for login notifications, password resets and as a login alias.
- user_access_groupUserAccessGroup3
  User access group of the user. Defines the rights of the user for all scopes.
- positioningeneralstring
  Free text describing the position or role of the user.
- crm_personCRMPerson10
  CRM person linked to this login user. Connects the login account with the person record.
- profile_picture_urlstring
  URL of the profile picture of the user.
- archivedboolean
  Marks the user as archived. Archived users are kept for history and are not active.
- require2faboolean
  Two-factor authentication is required for this user.
- user_frontend_dataUserFrontendData
  Saved UI settings and favorites of the user.
- search_stringstring
  Text that the entity can be searched by.
selectedcustomerCustomerProfile
Customer profile selected in the session.
Show fields (6)
- idinteger
  Primary key of the customer profile. Internal ID.
- slackchannelstring
  Slack channel of the customer profile.
- displaynamestring
  Name shown for the customer profile.
- deletedboolean
  Whether the customer profile is deleted.
- createdstring (date-time)
  Point in time the entity was created.
- updatedstring (date-time)
  Point in time the entity was last updated.
startstring (date-time)
Point in time the session started.
refreshed_startstring (date-time)
Point in time the session was last refreshed.
ipstring
IP address of the client.
validboolean
Whether the session is valid.
is_api_keyboolean
Whether the session was created with an API key.
is_dgboolean
Whether the session is for the DG (member organization) context.
missing2faboolean
Whether two-factor authentication is still missing.
start_in_vpnboolean
Whether the session started in a VPN.
auth_by_credentialsboolean
Whether the session was authenticated with user name and password.
auth_by_googleboolean
Whether the session was authenticated with Google.
auth_by_microsoftboolean
Whether the session was authenticated with Microsoft.
auth_by_cloudflareboolean
Whether the session was authenticated with Cloudflare Access.

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/sessions \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/sessions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/sessions"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/sessions', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/sessions"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/sessions")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/sessions"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/session_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await SessionController.getSession();
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "sessionid": "string",
  "user": {
    "id": 42,
    "name": "Beispiel",
    "username": "lena.hartmann@example.org",
    "email": "lena.hartmann@example.org",
    "profile_picture_url": "https://vynst.de",
    "positioningeneral": "string",
    "crm_person": {
      "id": 42,
      "first_name": "Lena",
      "last_name": "Hartmann",
      "title": "Beispiel",
      "language": "de",
      "support_description": "Text",
      "profile_picture_url": "https://vynst.de",
      "address_street": "Jakobistr. 39",
      "address_city": "Hannover",
      "address_zip": "30163"
    },
    "archived": true,
    "require2fa": true,
    "user_frontend_data": {
      "id": 42
    }
  },
  "selectedcustomer": {
    "id": 42,
    "slackchannel": "string",
    "displayname": "string",
    "deleted": true,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  },
  "start": "2026-10-15T09:30:00+02:00",
  "refreshed_start": "2026-10-15T09:30:00+02:00",
  "ip": "string",
  "valid": true,
  "is_api_key": true,
  "is_dg": true
}

Update Customer Profile on User

POST/api/sessions

Request body application/json

switchcustomerprofileSwitchCustomerProfile
Show fields (1)
- customerprofilestring

Responses

200Update Customer Profile on UserSession2

Show fields (16)

idinteger
Primary key of the session. Internal ID.
sessionidstring
ID of the session.
userUser4
User the session belongs to.
Show fields (12)
- idinteger
  Primary key of the user. Internal ID of the login user.
- namestring
  Display name of the user. Shown in the UI and in audit entries.
- usernamestring
  Login name of the user. Must be unique across all users.
- emailstring
  E-mail address of the user. Used for login notifications, password resets and as a login alias.
- user_access_groupUserAccessGroup3
  User access group of the user. Defines the rights of the user for all scopes.
- positioningeneralstring
  Free text describing the position or role of the user.
- crm_personCRMPerson10
  CRM person linked to this login user. Connects the login account with the person record.
- profile_picture_urlstring
  URL of the profile picture of the user.
- archivedboolean
  Marks the user as archived. Archived users are kept for history and are not active.
- require2faboolean
  Two-factor authentication is required for this user.
- user_frontend_dataUserFrontendData
  Saved UI settings and favorites of the user.
- search_stringstring
  Text that the entity can be searched by.
selectedcustomerCustomerProfile
Customer profile selected in the session.
Show fields (6)
- idinteger
  Primary key of the customer profile. Internal ID.
- slackchannelstring
  Slack channel of the customer profile.
- displaynamestring
  Name shown for the customer profile.
- deletedboolean
  Whether the customer profile is deleted.
- createdstring (date-time)
  Point in time the entity was created.
- updatedstring (date-time)
  Point in time the entity was last updated.
startstring (date-time)
Point in time the session started.
refreshed_startstring (date-time)
Point in time the session was last refreshed.
ipstring
IP address of the client.
validboolean
Whether the session is valid.
is_api_keyboolean
Whether the session was created with an API key.
is_dgboolean
Whether the session is for the DG (member organization) context.
missing2faboolean
Whether two-factor authentication is still missing.
start_in_vpnboolean
Whether the session started in a VPN.
auth_by_credentialsboolean
Whether the session was authenticated with user name and password.
auth_by_googleboolean
Whether the session was authenticated with Google.
auth_by_microsoftboolean
Whether the session was authenticated with Microsoft.
auth_by_cloudflareboolean
Whether the session was authenticated with Cloudflare Access.

Request

curl --request POST \
  --url https://your-instance.iw-erp.de/api/sessions \
  --header 'content-type: application/json' \
  --header 'x-iw-jwt-token: <TOKEN>' \
  --data '
{
  "switchcustomerprofile": {
    "customerprofile": "string"
  }
}
'

const options = {
  method: 'POST',
  headers: {'x-iw-jwt-token': '<TOKEN>', 'content-type': 'application/json'},
  body: JSON.stringify({switchcustomerprofile: {customerprofile: 'string'}})
};

fetch('https://your-instance.iw-erp.de/api/sessions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/sessions"

payload = { "switchcustomerprofile": { "customerprofile": "string" } }
headers = {
  "x-iw-jwt-token": "<TOKEN>",
  "content-type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://your-instance.iw-erp.de/api/sessions', [
  'body' => '{"switchcustomerprofile":{"customerprofile":"string"}}',
  'headers' => [
    'content-type' => 'application/json',
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Post,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/sessions"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
  Content = new StringContent("{\"switchcustomerprofile\":{\"customerprofile\":\"string\"}}")
  {
    Headers =
    {
      ContentType = new MediaTypeHeaderValue("application/json")
    }
  }
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\"switchcustomerprofile\":{\"customerprofile\":\"string\"}}");
Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/sessions")
  .post(body)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .addHeader("content-type", "application/json")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/sessions"

	payload := strings.NewReader("{\"switchcustomerprofile\":{\"customerprofile\":\"string\"}}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")
	req.Header.Add("content-type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/session_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';
import 'package:iw_erp_api/model/customer_profile.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await SessionController.setCustomerProfile(CustomerProfile.fromJson({
  "customerprofile": "string"
}));
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "sessionid": "string",
  "user": {
    "id": 42,
    "name": "Beispiel",
    "username": "lena.hartmann@example.org",
    "email": "lena.hartmann@example.org",
    "profile_picture_url": "https://vynst.de",
    "positioningeneral": "string",
    "crm_person": {
      "id": 42,
      "first_name": "Lena",
      "last_name": "Hartmann",
      "title": "Beispiel",
      "language": "de",
      "support_description": "Text",
      "profile_picture_url": "https://vynst.de",
      "address_street": "Jakobistr. 39",
      "address_city": "Hannover",
      "address_zip": "30163"
    },
    "archived": true,
    "require2fa": true,
    "user_frontend_data": {
      "id": 42
    }
  },
  "selectedcustomer": {
    "id": 42,
    "slackchannel": "string",
    "displayname": "string",
    "deleted": true,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  },
  "start": "2026-10-15T09:30:00+02:00",
  "refreshed_start": "2026-10-15T09:30:00+02:00",
  "ip": "string",
  "valid": true,
  "is_api_key": true,
  "is_dg": true
}

This method will get the sso link with a token - set query parameter durableJwt=1 to get a long-lasting token without the option to login as the user

GET/api/sessions/{serviceName}/sso

Path parameters

serviceNamerequiredstring

Responses

200This method will get the sso link with a token - set query parameter durableJwt=1 to get a long-lasting token without the option to login as the userOpenDataRedirect

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/sessions/42/sso \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/sessions/42/sso', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/sessions/42/sso"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/sessions/42/sso', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/sessions/42/sso"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/sessions/42/sso")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/sessions/42/sso"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/session_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await SessionController.getSessionSso('42');
if (result.success) {
  print(result.data);
}

Response 200 application/json

{}

Verify 2FA code for this session

GET/api/session/verify2fa/{id}/{code}

Path parameters

`id`requiredstring
`code`requiredstring

Responses

200Verify 2FA code for this sessionSession2

Show fields (16)

idinteger
Primary key of the session. Internal ID.
sessionidstring
ID of the session.
userUser4
User the session belongs to.
Show fields (12)
- idinteger
  Primary key of the user. Internal ID of the login user.
- namestring
  Display name of the user. Shown in the UI and in audit entries.
- usernamestring
  Login name of the user. Must be unique across all users.
- emailstring
  E-mail address of the user. Used for login notifications, password resets and as a login alias.
- user_access_groupUserAccessGroup3
  User access group of the user. Defines the rights of the user for all scopes.
- positioningeneralstring
  Free text describing the position or role of the user.
- crm_personCRMPerson10
  CRM person linked to this login user. Connects the login account with the person record.
- profile_picture_urlstring
  URL of the profile picture of the user.
- archivedboolean
  Marks the user as archived. Archived users are kept for history and are not active.
- require2faboolean
  Two-factor authentication is required for this user.
- user_frontend_dataUserFrontendData
  Saved UI settings and favorites of the user.
- search_stringstring
  Text that the entity can be searched by.
selectedcustomerCustomerProfile
Customer profile selected in the session.
Show fields (6)
- idinteger
  Primary key of the customer profile. Internal ID.
- slackchannelstring
  Slack channel of the customer profile.
- displaynamestring
  Name shown for the customer profile.
- deletedboolean
  Whether the customer profile is deleted.
- createdstring (date-time)
  Point in time the entity was created.
- updatedstring (date-time)
  Point in time the entity was last updated.
startstring (date-time)
Point in time the session started.
refreshed_startstring (date-time)
Point in time the session was last refreshed.
ipstring
IP address of the client.
validboolean
Whether the session is valid.
is_api_keyboolean
Whether the session was created with an API key.
is_dgboolean
Whether the session is for the DG (member organization) context.
missing2faboolean
Whether two-factor authentication is still missing.
start_in_vpnboolean
Whether the session started in a VPN.
auth_by_credentialsboolean
Whether the session was authenticated with user name and password.
auth_by_googleboolean
Whether the session was authenticated with Google.
auth_by_microsoftboolean
Whether the session was authenticated with Microsoft.
auth_by_cloudflareboolean
Whether the session was authenticated with Cloudflare Access.

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/session/verify2fa/42/42 \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/session/verify2fa/42/42', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/session/verify2fa/42/42"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/session/verify2fa/42/42', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/session/verify2fa/42/42"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/session/verify2fa/42/42")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/session/verify2fa/42/42"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/session_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await SessionController.verify2Factor('42', '42');
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "sessionid": "string",
  "user": {
    "id": 42,
    "name": "Beispiel",
    "username": "lena.hartmann@example.org",
    "email": "lena.hartmann@example.org",
    "profile_picture_url": "https://vynst.de",
    "positioningeneral": "string",
    "crm_person": {
      "id": 42,
      "first_name": "Lena",
      "last_name": "Hartmann",
      "title": "Beispiel",
      "language": "de",
      "support_description": "Text",
      "profile_picture_url": "https://vynst.de",
      "address_street": "Jakobistr. 39",
      "address_city": "Hannover",
      "address_zip": "30163"
    },
    "archived": true,
    "require2fa": true,
    "user_frontend_data": {
      "id": 42
    }
  },
  "selectedcustomer": {
    "id": 42,
    "slackchannel": "string",
    "displayname": "string",
    "deleted": true,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  },
  "start": "2026-10-15T09:30:00+02:00",
  "refreshed_start": "2026-10-15T09:30:00+02:00",
  "ip": "string",
  "valid": true,
  "is_api_key": true,
  "is_dg": true
}