# Mint a short chat bearer `POST /chat-session/bearer` Fresh JSON IdP proof derives owner. Body is closed; unknown or missing fields are 400 before proof verification. Requires holderProof; bearer expires at the least of 900 seconds, IdP proof expiry and session expiry. Origin is refused. Effect failures preserve native code and outcome; missing native outcome means unknown. Retain the same holder on an uncertain retry. Credential verification and native dispatch failures share the public peer refusal budget. ### Parameters No operation parameters. ### Request body UTF-8 JSON; maximum 65536 bytes. An Authorization header does not replace the JSON proof. Required: yes. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatBearer" } ``` ### Responses #### HTTP 200 Successful response. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Bearer" } ``` #### HTTP 400 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 401 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 403 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 404 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 405 JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 409 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 412 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 413 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 415 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 429 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 500 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 501 Native refusal where code and outcome are supplied by the chat handler. Pre-dispatch method, Origin, media type and shape refusals are not-executed. Native outcome may be not-executed, executed or unknown. JSON parse/size errors and public admission/deadline errors have only error, without code or outcome. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ChatError" } ``` #### HTTP 503 Public admission cap (64 in flight), 10 second request deadline, or a route-specific unavailable read/effect. A service authority 503 may follow a binding; retain the request identity. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` Authentication and access: HTTP interface of the stock auth public listener: 11 paths and 12 operations. Public means reachable through the configured listener, not unauthenticated. This implementation surface uses Cotal native contracts and does not establish a stable cloud API. Description version 1.0.0 identifies this document, not the wire or npm package version. Credentials are JSON body proofs, with no loopback capability required. No CORS headers are sent. All POST routes and service authority GET reject any Origin header. Health, JWKS and mesh discovery GET permit Origin headers. The listener binds 127.0.0.1; an operator HTTPS proxy supplies the external origin. Service endpoint routes require service endpoints enabled. Route lookup uses the exact request target: query strings and trailing slashes do not match and return JSON 404. Unknown paths and loopback-only lifecycle, enrollment verification, human-proof and consent routes return JSON 404. Configuration and route-specific native parser checks remain authoritative. POST JSON bodies default to 65536 bytes; service authority accepts 2097152 bytes. Public work has 64 concurrent admissions and a 10000 ms deadline. Its separate rolling 30-refusal/minute peer budget is bounded to 1024 peer entries. Failure accounting is route-specific. Manager dispatch failures and chat native or store failures can consume the budget after valid proof verification. Otherwise successful requests are still evaluated when the refusal budget is full. Peer is socket address unless trusted proxy mode selects the last X-Forwarded-For hop. [OpenAPI specification](https://docs.cotal.ai/auth.openapi.json) contains the referenced response schemas. [Complete Markdown reference](/api/auth.md).