Sessions
Shared-sessions protocol v2: event log, controls, executor lease, dispatch and the live SSE stream.
Every call carries x-codai-device (a stable UUID) — that header is what selects protocol v2 and registers the device. One executor holds the lease; viewers and editors send controls; everyone reads the same event log. The protocol itself is specified in the sessions section.
Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidHuman-readable device name used when the device is first registered (truncated to 120 chars).
length <= 120Platform recorded on first registration; unknown values become agent.
Value in
- "android"
- "ios"
- "web"
- "desktop"
- "cli"
- "agent"
Client correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/sessions" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34", "session_key": "desktop-2026-09-23-main", "owner_user_id": "65139110-7c3c-4777-b692-80c218be3b9d", "title": "string", "created_at": "2019-08-24T14:15:22Z", "last_event_at": "2019-08-24T14:15:22Z", "last_seq": 0, "executor_device_id": "4a403d11-3f52-4f9c-8024-3e4b6ac6da4c", "lease_expires_at": "2019-08-24T14:15:22Z", "e2e": true, "archived": true}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Query Parameters
Max rows per list (own and shared are capped separately). Default 50, max 200.
0 <= value <= 20050Include archived sessions when 1 or true.
Value in
- "0"
- "1"
- "true"
- "false"
Force protocol v2 without the device header. Only 2 is meaningful.
Value in
- "2"
Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidHuman-readable device name used when the device is first registered (truncated to 120 chars).
length <= 120Platform recorded on first registration; unknown values become agent.
Value in
- "android"
- "ios"
- "web"
- "desktop"
- "cli"
- "agent"
Client correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/sessions" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "sessions": [ { "id": "3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34", "session_key": "desktop-2026-09-23-main", "owner_user_id": "65139110-7c3c-4777-b692-80c218be3b9d", "title": "string", "created_at": "2019-08-24T14:15:22Z", "last_event_at": "2019-08-24T14:15:22Z", "last_seq": 0, "executor_device_id": "4a403d11-3f52-4f9c-8024-3e4b6ac6da4c", "lease_expires_at": "2019-08-24T14:15:22Z", "e2e": true, "archived": true, "role": "viewer", "presence_count": 0 } ]}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Query Parameters
Force protocol v2 without the device header. Only 2 is meaningful.
Value in
- "2"
Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidHuman-readable device name used when the device is first registered (truncated to 120 chars).
length <= 120Platform recorded on first registration; unknown values become agent.
Value in
- "android"
- "ios"
- "web"
- "desktop"
- "cli"
- "agent"
Client correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "id": "3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34", "session_key": "desktop-2026-09-23-main", "owner_user_id": "65139110-7c3c-4777-b692-80c218be3b9d", "title": "string", "created_at": "2019-08-24T14:15:22Z", "last_event_at": "2019-08-24T14:15:22Z", "last_seq": 0, "executor_device_id": "4a403d11-3f52-4f9c-8024-3e4b6ac6da4c", "lease_expires_at": "2019-08-24T14:15:22Z", "e2e": true, "archived": true, "role": "viewer", "members": [ { "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5", "role": "viewer", "remote": true, "devices": [ { "device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940", "name": "string", "platform": "android", "last_seen_at": "2019-08-24T14:15:22Z", "remote": true } ] } ], "lease": { "device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940", "expires_at": "2019-08-24T14:15:22Z" }, "presence": [ { "device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940", "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5", "role": "viewer", "executor": true, "last_seen": 1758614400000, "driving": true, "remote": true } ]}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidClient correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
At least one of title / archived is required.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X PATCH "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34", "session_key": "desktop-2026-09-23-main", "owner_user_id": "65139110-7c3c-4777-b692-80c218be3b9d", "title": "string", "created_at": "2019-08-24T14:15:22Z", "last_event_at": "2019-08-24T14:15:22Z", "last_seq": 0, "executor_device_id": "4a403d11-3f52-4f9c-8024-3e4b6ac6da4c", "lease_expires_at": "2019-08-24T14:15:22Z", "e2e": true, "archived": true}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidClient correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "deleted": true, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Query Parameters
Return events with seq strictly greater than this value. Default 0.
0 <= value0Page size. Default 200, max 1000.
0 <= value <= 1000200Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidClient correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/events" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "last_seq": 42, "events": [ { "seq": 1, "kind": "user_message", "ts": 1758614400000, "sender_device_id": "bc45c0f5-ada8-4820-b7a5-8dc052568462", "turn_id": "string", "client_event_id": "string", "payload": {} } ]}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidHuman-readable device name used when the device is first registered (truncated to 120 chars).
length <= 120Platform recorded on first registration; unknown values become agent.
Value in
- "android"
- "ios"
- "web"
- "desktop"
- "cli"
- "agent"
Client correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/events" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{ "events": [ { "kind": "string" } ] }'{ "last_seq": 0, "accepted": 0, "events": [ { "client_event_id": "string", "seq": 0 } ]}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Query Parameters
Return applied (1/true) instead of pending controls. Default pending.
Value in
- "0"
- "1"
- "true"
- "false"
me (the calling device) or a device UUID; only controls dispatched at that device are returned.
Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidClient correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/controls" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "controls": [ { "id": "string", "kind": "send", "text": "string", "turn_id": "string", "ask_id": "string", "from_device_id": "10624cda-85b4-412c-80da-8ce165bfd5b0", "target_device_id": "12785743-1d27-41cd-88a7-0ac66360e3d6", "seq": 0, "applied": true, "created_at": "2019-08-24T14:15:22Z" } ]}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidHuman-readable device name used when the device is first registered (truncated to 120 chars).
length <= 120Platform recorded on first registration; unknown values become agent.
Value in
- "android"
- "ios"
- "web"
- "desktop"
- "cli"
- "agent"
Client correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/control" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{ "id": "ctl-01J8Z7Q2K9", "kind": "send" }'{ "accepted": true, "seq": 0, "duplicate": true}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256The client-chosen control id.
length <= 128Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidClient correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/control/string/applied" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "id": "string", "applied": true}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidHuman-readable device name used when the device is first registered (truncated to 120 chars).
length <= 120Platform recorded on first registration; unknown values become agent.
Value in
- "android"
- "ios"
- "web"
- "desktop"
- "cli"
- "agent"
Client correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/dispatch" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{ "device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940", "text": "string" }'{ "control_id": "dispatch:8c2e5f1a-7b3d-4c9e-a0f1-2d3e4f5a6b7c", "seq": 0, "target_device_id": "12785743-1d27-41cd-88a7-0ac66360e3d6", "queued": true, "pushed": true, "duplicate": true, "push_reason": "no_push_token"}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidHuman-readable device name used when the device is first registered (truncated to 120 chars).
length <= 120Platform recorded on first registration; unknown values become agent.
Value in
- "android"
- "ios"
- "web"
- "desktop"
- "cli"
- "agent"
Client correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/lease" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{}'{ "session_id": "1ffd059c-17ea-40a8-8aef-70fd0307db82", "device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940", "expires_at": "2019-08-24T14:15:22Z"}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidClient correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X PUT "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/lease" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "session_id": "1ffd059c-17ea-40a8-8aef-70fd0307db82", "device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940", "expires_at": "2019-08-24T14:15:22Z"}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidClient correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
application/json
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/lease" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "session_id": "1ffd059c-17ea-40a8-8aef-70fd0307db82", "released": true}Authorization
bearerAuth A codai API key (codai_ prefix). Ephemeral tokens from POST /v1/tokens are accepted only by /v1/realtime.
In: header
Path Parameters
Server UUID of the session OR its client session_key. Own sessions win on session_key collisions.
length <= 256Query Parameters
Replay events with seq strictly greater than this before going live. Default 0 (full replay, capped at 1000).
0 <= value0Header Parameters
Stable device UUID. Registers the device on first use (name/platform from x-codai-device-name / x-codai-device-platform) and selects the shared-sessions protocol.
uuidHuman-readable device name used when the device is first registered (truncated to 120 chars).
length <= 120Platform recorded on first registration; unknown values become agent.
Value in
- "android"
- "ios"
- "web"
- "desktop"
- "cli"
- "agent"
Client correlation id; echoed back as x-codai-trace-id and persisted on the usage row.
length <= 128Response Body
text/event-stream
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/sessions/3f7a4c1e-9b2d-4e8f-a1b6-5c0d7e2f9a34/stream" \ -H "x-codai-device: 497f6eca-6276-4993-bfeb-53cbbbba6f08""string"