renewBrowserPlayerSession

POST

/api/v1/player/browser/renew

curl --request POST \
  --url https://example.com/api/v1/player/browser/renew \
  --header 'Content-Type: application/json' \
  --data '{ "slotId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "bindingId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "nonce": "example", "signature": "example" }'

Consume the challenge before verification. The signature covers the exact challenge message the Server issued. The Server rebuilds that message from the slot, binding and nonce and never accepts client-supplied signing text. Verify a P-256 SHA-256 WebCrypto P1363 signature. Issue a fresh HttpOnly session only for the active binding epoch.

Request Body^required

Media typeapplication/json

object

slotId

required

string format: uuid

bindingId

required

string format: uuid

nonce

required

string

>= 43 characters <= 43 characters

signature

required

string

>= 86 characters <= 86 characters

Example^generated

{
  "slotId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "bindingId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "nonce": "example",
  "signature": "example"
}

Responses

200

Browser session cookie renewed

Media typeapplication/json

object

data

required

object

slotId

required

string format: uuid

bindingId

required

string format: uuid

screenId

required

string format: uuid

screenName

required

string

epoch

required

integer format: int64

>= 1

expiresAt

required

string format: date-time

Example^generated

{
  "data": {
    "slotId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "bindingId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "screenId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "screenName": "example",
    "epoch": 1,
    "expiresAt": "2026-04-15T12:00:00Z"
  }
}

401

Challenge, signature, or binding is invalid

403

Same-origin HTTPS required

429

Rate limited