# Create a session

Creates a new session.

Endpoint: POST /v3/sessions
Version: 2026-01-08
Security: ZephrHmacHttp

## Request fields (application/json):

  - `identifiers` (object, required)
    Example: {"email_address":"joe.blow@company.com"}

  - `identifiers.email_address` (string)
    Example: "joe.blow@company.com"

  - `validators` (object, required)
    Example: {"password":"mysecurepassword123"}

  - `validators.password` (string)
    Example: "mysecurepassword123"

  - `validators.use_sso` (boolean)
    When this is present there should be no identifiers in the body. The user is identified through a blaize_session cookie.

## Response 200 fields (application/json):

  - `tenantId` (string)
    Example: "company"

  - `subTenantId` (string)
    Example: "company|demo"

  - `supplied` (boolean)

  - `expiryDate` (string)
    Example: "2025-02-08 14:29 PM UTC"

  - `startDate` (string)
    Example: "2024-02-08 14:29 PM UTC"

  - `authenticated` (boolean)
    Example: true

  - `state` (string)
    Enum: "anonymous", "recognised", "partially_registered", "authenticated"

  - `device` (string)
    Example: "pc"

  - `browser` (string)
    Example: "Chrome"

  - `os` (string)
    Example: "Mac OSX"

  - `city` (string)
    Example: "London"

  - `geoState` (string)
    Example: "London"

  - `deviceName` (string)
    Example: "Apple Macintosh"

  - `country` (string)
    ISO-3166-2 country code
    Example: "GB"

  - `session_id` (string)
    Example: "26a73b7a-f7d0-48d8-85dd-a04b07313895"

  - `user_id` (string)
    Example: "UU0123456789ABCD"


## Response 400 fields