> ## Documentation Index > Fetch the complete documentation index at: https://developers.primulamanagement.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a session > Authenticate with username and password. A single JSON object is required and unknown properties are rejected. Returns access_token and refresh_token with HTTP 201; V3 has no refresh or logout operation. ## OpenAPI ````yaml /openapi.yaml post /sessions openapi: 3.1.0 info: title: Primula Tracker API V3 version: 3.0.0 description: >- Reference for the 66 operations registered under `/primula/api/v3` in the V3 release baseline. ## Authentication Create a session with `POST /sessions`, then send `Authorization: Bearer ` on protected operations. Tokens must remain associated with a valid server-side session. The returned refresh token has no refresh endpoint in V3. Session company and school restrictions are documented per operation; company_id is not inferred from the token. ## Responses and errors Collections generally return bare JSON arrays and items return bare JSON objects. Report objects, nested maps, and update summaries are explicitly described below. List metadata travels in response headers rather than an envelope. Empty lists written by collection helpers are `[]`; fields backed by nullable values may be `null`, and omitted properties are distinguished from null properties in schemas. Handlers generally return `{ "error": "message" }`; authentication middleware and activity proxy errors use plain text. Unsupported methods on a registered path return 405 with Allow after any applicable authentication checks. ## Pagination and projections Only operations documenting page/per_page support pagination. Defaults are page=1 and per_page=100. Values exceeding the documented effective cap are clamped, not rejected. X-Total-Count describes the full matching set. Link contains applicable navigation links and is omitted for a single page. Aggregates use limit (default 50, effective cap 200) instead of pagination and send X-Truncated only when rows were omitted. The fields parameter, where available, selects the exact response properties; unsupported fields return 400. ## Query encoding Multi-value parameters documented as arrays accept repeated keys or comma-separated values. Prefer repeated keys for long UUID lists. Except for the two activity proxy operations, query parsing drops the entire query string above 8192 bytes and truncates each decoded query value to 128 bytes. Parameter combinations and interpretation differ by resource and representation; consult each operation. Unknown parameters are rejected only where explicitly documented. ## Dates and writes Calendar dates use YYYY-MM-DD, monthly periods use YYYY-MM, and timestamp formats are described in the corresponding schema. Defaults such as today depend on the server clock. PATCH operations change only the documented properties and reject unknown body properties. Clearing values, authorization, and partial-write behavior vary by resource and are described per operation. Examples use synthetic identifiers and placeholder tokens. Replace the server host before using an interactive API client. servers: - url: https://{host}/primula/api/v3 description: V3 API deployment. Replace the placeholder hostname. variables: host: default: api.example.com security: - bearerAuth: [] tags: - name: sessions description: Sessions. - name: schools description: Schools. - name: companies description: Companies. - name: rooms description: Rooms. - name: users description: Users. - name: gusto_companies description: Gusto companies. - name: gusto_employees description: Gusto employees. - name: gusto_contractors description: Gusto contractors. - name: gusto_payrolls description: Gusto payrolls. - name: procare_staff description: Procare staff. - name: efficiency_ratios description: Efficiency ratios. - name: enrollment_tracker description: Enrollment tracker. - name: classroom_attendance description: Classroom attendance. - name: absences description: Absences. - name: billing_attendance_audits description: Billing attendance audits. - name: data_refresh description: Data refresh. - name: waitlist description: Waitlist. - name: sibling_discounts description: Sibling discounts. - name: new_start_tracker description: New start tracker. - name: withdrawal_tracker description: Withdrawal tracker. - name: transition_tracker description: Transition tracker. - name: enrollments description: Enrollments. - name: pre_registration_fallout description: Pre registration fallout. - name: procare_messages description: Procare messages. - name: activities_summary description: Activities summary. - name: activity_details description: Activity details. - name: leads description: Leads. - name: students description: Students. - name: payments description: Payments. - name: family_balances description: Family balances. - name: attendances description: Attendances. - name: billing_plans description: Billing plans. - name: spaces description: Spaces. paths: /sessions: post: tags: - sessions summary: Create a session description: >- Authenticate with username and password. A single JSON object is required and unknown properties are rejected. Returns access_token and refresh_token with HTTP 201; V3 has no refresh or logout operation. operationId: PostSessionsV3 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateSessionRequest' example: username: example.user password: responses: '201': description: Successful response. content: application/json: schema: $ref: '#/components/schemas/Session' example: access_token: refresh_token: '400': $ref: '#/components/responses/400' '401': description: Invalid username or password. This public handler returns JSON. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Invalid credentials '405': $ref: '#/components/responses/405' '415': $ref: '#/components/responses/415' '500': $ref: '#/components/responses/500' security: [] components: schemas: CreateSessionRequest: type: object properties: username: type: string minLength: 1 password: type: string minLength: 1 writeOnly: true required: - username - password additionalProperties: false description: Create Session Request. Session: type: object properties: access_token: type: string refresh_token: type: string required: - access_token - refresh_token description: Session. Error: type: object properties: error: type: string description: Human-readable error message. required: - error description: Error. responses: '400': description: Invalid or missing parameters or request body. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Invalid or missing parameters or request body. '405': description: The path exists but does not support this HTTP method. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: The path exists but does not support this HTTP method. headers: Allow: description: Comma-separated HTTP methods accepted by this path. schema: type: string '415': description: >- The request Content-Type must be application/json; charset parameters are accepted. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: >- The request Content-Type must be application/json; charset parameters are accepted. '500': description: The operation could not be completed. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: The operation could not be completed. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Access token issued by POST /sessions and associated with a valid server-side session. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.