> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GET /session/token

The **Session Token** API redeems a Digital Identity Management action token, and calls/invokes the next Process as defined by the token's context. The next Process may be:

* a single API or step like the [Activate User (and User Attribute) Process](c_activateUser) that verifies a user's email or mobile.
* a multi-step process such as the [Accept or Decline Service Invitation Process](c_acceptDeclineServiceInvitation) that requires more information from the user. Upon acceptance of the invite, the user is directed through the required steps to complete their onboarding.

## Token Issuance & Redemption

There are two methods on how action tokens are issued and redeemed:

* A long-form, clickable verification link that includes a redirect URL and the actual token value (appended to the end of the URL string). Once the user clicks this link, the redirect URL should navigate back to the client application, and the application provides that token value in this API request URL.
* A short-form, custom One-time Passcode (OTP) that represents the token value stored in Digital Identity Management. The user must manually supply the OTP to a Process through the application UI, and the UI must then supply both the OTP and its corresponding PKAT in this API request URL.

**Note:** The notification types that your end users receive are based on the notification settings and templates used in your flows. These settings are configured in the Digital Identity Management [Admin console](https://docs.vindicia.com/bundle/b_connectAdminGuide/page/topics/appSettings_c.html). See the Digital Identity Management Admin Guide [About Notification Services](https://docs.vindicia.com/bundle/b_connectAdminGuide/page/topics/notificationServicesAbout_c.html) and [Notification Templates](https://docs.vindicia.com/bundle/b_connectAdminGuide/page/topics/templatesAbout_c.html) for more details.

## API URLs

* `GET https://{your.tenant.url}/session/token?token={**token**}`
* `GET https://{your/tenant.url}/session/token?customToken={**OTP**}&pkat={**PKAT**}`

## Request Parameters

| `token` | Action token value that's appended to the end of the redirect URL sent to the end user.**Note:** Redirect URLs are defined in the Digital Identity Management **Admin console** > **Authentication** > **Tokens** > **Advanced token Settings** page. An Admin user can set separate redirect URLs for each of the Processes. This configuration can used for end users that receive clickable links (versus OTPs) are redirected to the landing page you've defined. Alternatively, you can set a single landing page for all your Processes. This configuration requires that the landing page extracts the token value from the redirect URL to call or invoke the Session Token API. |
| - | - |
| `customToken` | Short-form One-time Passcode (OTP) that represents the actual action token issued and stored in Digital Identity Management. Used in cases where you want to send the user a short code, and prompt the user to enter the code into the client application UI. |
| `pkat` | Proof Key for Action Token is sent to the client application UI at the end of any Process that issues and sends an action token to a user's specified contact channel. The PKAT is required for OTP verification and Token Resend [PUT /session/token?pkat=\{pkat\}](c_putSessionToken) functionality. |
| As a developer, determine the required notification settings based on what token types are sent to your end users. For example, if the system issues OTPs to end users, then your application requires a UI page that allows a user to provide the OTP to this API. | |

<img src="https://mintcdn.com/amdocs-ulm/XSI-_zBHRIt1HJAz/portal/m1Connect/processGuide/images/m1c_getSessionTokenEx.png?fit=max&auto=format&n=XSI-_zBHRIt1HJAz&q=85&s=ce8793e298aac4d302082ff8dd6cd0c5" alt="" width="333" height="236" data-path="portal/m1Connect/processGuide/images/m1c_getSessionTokenEx.png" />

## Related Processes

The following Processes are invoked using the Session Token API:

* [Activate User (and User Attribute) Process](c_activateUser)
* [Recover ID & Reset Password Processes](c_forgotPassword)
* [Accept or Decline Service Invitation Process](c_acceptDeclineServiceInvitation)

**Parent topic:**[Process APIs](../topics/c_processAPIsdita)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.