curl -X POST "https://api.triggr-app.com/api/v1/core/forms/<slug>/sessions" \
-H "Authorization: Bearer $TRIGGR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"user": {
"userIdentifier": "jane.doe@contoso.com",
"clientId": "c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f"
}
}'const res = await fetch("https://api.triggr-app.com/api/v1/core/forms/<slug>/sessions", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.TRIGGR_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"user": {
"userIdentifier": "jane.doe@contoso.com",
"clientId": "c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f"
}
}),
});
if (!res.ok) throw new Error(`Triggr ${res.status}: ${await res.text()}`);
const data = await res.json();$headers = @{
Authorization = "Bearer $env:TRIGGR_API_KEY"
}
$body = @'
{
"user": {
"userIdentifier": "jane.doe@contoso.com",
"clientId": "c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f"
}
}
'@
Invoke-RestMethod -Method Post -Uri 'https://api.triggr-app.com/api/v1/core/forms/<slug>/sessions' -Headers $headers -ContentType 'application/json' -Body $bodyimport requests
url = "https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions"
payload = { "user": {
"clientId": "c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f",
"userIdentifier": "jane.doe@contoso.com"
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
user: {
clientId: 'c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f',
userIdentifier: 'jane.doe@contoso.com'
}
})
};
fetch('https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'user' => [
'clientId' => 'c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f',
'userIdentifier' => 'jane.doe@contoso.com'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions"
payload := strings.NewReader("{\n \"user\": {\n \"clientId\": \"c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f\",\n \"userIdentifier\": \"jane.doe@contoso.com\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"user\": {\n \"clientId\": \"c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f\",\n \"userIdentifier\": \"jane.doe@contoso.com\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"user\": {\n \"clientId\": \"c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f\",\n \"userIdentifier\": \"jane.doe@contoso.com\"\n }\n}"
response = http.request(request)
puts response.read_body{
"embedUrl": "https://core.triggr-app.com/telescope/forms/org_2Ab3Cd4Ef5Gh6Ij7Kl/onboarding?formSession=8b1e5d0c93a74f26e1d4c7a2",
"expiresIn": 120,
"formSessionHandle": "8b1e5d0c93a74f26e1d4c7a2",
"provider": "microsoft"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}Start an embedded session for a Core form
Core public forms are Microsoft-only: give the user’s object ID or UPN plus their tenant (microsoftTenantId, or clientId). The form must be public — base availability, and any override for that client — and a form that is not is a 400, not a 403. The handle is single-use and expires after 2 minutes: mint one per page load, server-side. The user must belong to a client this organisation manages — their Microsoft tenant connected, or their Google Workspace domain mapped to a client — otherwise 403. The signed-in session lasts 30 minutes from when you mint it; after that a submit is refused and the page must be reloaded with a fresh handle. Every session is audited against the key that minted it, and a submission — and every workflow it triggers, as metadata.custom.apiKeyId — records which key embedded the form. The form’s own access rules still apply to the asserted identity.
curl -X POST "https://api.triggr-app.com/api/v1/core/forms/<slug>/sessions" \
-H "Authorization: Bearer $TRIGGR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"user": {
"userIdentifier": "jane.doe@contoso.com",
"clientId": "c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f"
}
}'const res = await fetch("https://api.triggr-app.com/api/v1/core/forms/<slug>/sessions", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.TRIGGR_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"user": {
"userIdentifier": "jane.doe@contoso.com",
"clientId": "c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f"
}
}),
});
if (!res.ok) throw new Error(`Triggr ${res.status}: ${await res.text()}`);
const data = await res.json();$headers = @{
Authorization = "Bearer $env:TRIGGR_API_KEY"
}
$body = @'
{
"user": {
"userIdentifier": "jane.doe@contoso.com",
"clientId": "c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f"
}
}
'@
Invoke-RestMethod -Method Post -Uri 'https://api.triggr-app.com/api/v1/core/forms/<slug>/sessions' -Headers $headers -ContentType 'application/json' -Body $bodyimport requests
url = "https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions"
payload = { "user": {
"clientId": "c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f",
"userIdentifier": "jane.doe@contoso.com"
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
user: {
clientId: 'c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f',
userIdentifier: 'jane.doe@contoso.com'
}
})
};
fetch('https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'user' => [
'clientId' => 'c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f',
'userIdentifier' => 'jane.doe@contoso.com'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions"
payload := strings.NewReader("{\n \"user\": {\n \"clientId\": \"c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f\",\n \"userIdentifier\": \"jane.doe@contoso.com\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"user\": {\n \"clientId\": \"c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f\",\n \"userIdentifier\": \"jane.doe@contoso.com\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.triggr-app.com/api/v1/core/forms/{slug}/sessions")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"user\": {\n \"clientId\": \"c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f\",\n \"userIdentifier\": \"jane.doe@contoso.com\"\n }\n}"
response = http.request(request)
puts response.read_body{
"embedUrl": "https://core.triggr-app.com/telescope/forms/org_2Ab3Cd4Ef5Gh6Ij7Kl/onboarding?formSession=8b1e5d0c93a74f26e1d4c7a2",
"expiresIn": 120,
"formSessionHandle": "8b1e5d0c93a74f26e1d4c7a2",
"provider": "microsoft"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retryable": true
}
}Authorizations
Organisation API key. Scoped operations carry x-triggr-scope; the scopes themselves are described in x-triggr-scopes.
Path Parameters
Body
Show child attributes
Show child attributes
Response
OK
Seconds the single-use handle stays redeemable (120). 0 when no handle is issued (provider none). Not the signed-in session's lifetime, which is 30 minutes from mint
microsoft, google, portal, none Absent only for a none form requested with no user

