Issue a session token
Give a running execution a new session token, and the widget link that carries it.
Every direct execution is born with one: its acceptance carries the session_token and, when you declared a person available, the widget_url built with it. Call this while it runs, when that link has to change hands — it leaked into a log, it was sent to the wrong person, your customer moved to another device — or when you want a link for an execution that has none: one whose token you revoked, or one started without customer_interaction_available. A closed execution gets no new token: there is nothing left for your customer to do.
The token the execution had opens nothing from this moment, and neither does any link built with it. There is one token per execution: issuing is replacing.
It expires with the execution, a day after the execution started — issuing a new token does not move that. The widget link carries no way back: append completion_url (and completion_mode) to it yourself, exactly as to the one the acceptance carried.
Server to server only. This call is authorised with your application secret: it belongs in your backend, never in a browser, a mobile app or anything your customer can read.
Authentication
Path parameters
Response
200 OK
The new token and its widget link. Whatever link you handed out before opens nothing any more.
A short-lived token that authorises acting on this execution and nothing else: it cannot read a single extracted record, and once the execution ends it only shows how it ended. It expires with the execution, and opens nothing once you delete the execution, revoke it or issue another.
Resolving a pause through this API needs none of it — collect the value and send it to the resume endpoint. The token is for the other option: handing that moment to your customer in our widget, which widget_url already carries it to. Keep it as you keep that URL.
The prefix says which kind of run issued it: st_test_ when the run is a rehearsal — a sandbox application, or a sandbox engine under a production one — and st_live_ otherwise.
Where your customer carries this execution on, opened by this token — the link the execution had opens nothing any more. Treat it as a credential, and append your way back (completion_url, completion_mode) to it yourself.
When the token stops opening anything, in UTC: the execution’s own expiration, a day after it started. Issuing another token does not move it.