REST API session endpoint

The session endpoint authenticates against Pulp and issues a signed session cookie for subsequent API calls. This is the only public endpoint; it does not require authentication.

Table 1. Session endpoints
Endpoint Description

POST /rhui/api/v1/login

Establish a Pulp session cookie for the API.

POST /rhui/api/v1/login

Authenticates against Pulp by using the Django login form and returns a signed rhuiSessionId cookie for subsequent calls. The cookie contains the Pulp sessionid, an absolute expiry, and an HMAC signature.

Cookie authentication is the preferred authentication method over HTTP Basic authentication, which creates a new Pulp session on every call. Creating a new session can be a significant overhead when many API calls are sent in a short time. The cookie expiry time is configured at the Red Hat Update Infrastructure level and is independent of the Pulp login session length, which is two weeks by default.

Table 2. Request body: LoginRequest (application/json)
Field Type Required Description

username

string

Yes

Pulp user name.

password

string

Yes

Pulp password.

On success, returns 200 with a LoginSuccess object (application/json), and a Set-Cookie header that issues the rhuiSessionId cookie. Common response codes also apply.

Table 3. Common response codes
Number Description Response

201

Client configuration RPM created — application/json

ClientRpmResponse

400

Invalid request — application/json

Error

401

Authentication required or invalid credentials — application/json

Error

500

Unexpected internal error — application/json

Error

503

Required session signing configuration is missing or invalid — application/json

Error