> For the complete documentation index, see [llms.txt](https://partner.doc.bunq.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://partner.doc.bunq.com/documentation/bunq-as-a-service/chapter-2-onboarding/create-a-session-on-behalf-of-the-user.md).

# Create a session on behalf of the user

## Step 1: Create SessionServer

Before creating notification filters, you need to establish a `SessionServer` using the `credential.token_value` obtained when the `PartnerUserProvision` becomes Active.

**Endpoint:**

```http
POST /v1/session-server
```

**Request Body:**

```json
{ 
    "secret": "<credential.token_value_from_created_provision>" 
}
```

The `token_value` is obtained from the credential object when the `PartnerUserProvision` status becomes `CREATED` and subStatus = `PENDING_PROCESS_USER_ONBOARDING` (as shown in Chapter 2).

**Response:**

```json
{
    "Response": [
        {
            "Id": {
                "id": 2173
            }
        },
        {
            "Token": {
                "id": 2173,
                "created": "2025-08-13 15:53:11.594918",
                "updated": "2025-08-13 15:53:11.594918",
                "token": "f981bd6d26b8328b89e85a774c404bb02e72d18062dab92bb59c9e59a1c5958f"
            }
        },
        {
            "UserApiKey": {
                "id": 1364,
                "created": "2025-08-13 15:53:11.286445",
                "updated": "2025-08-13 15:53:11.286445",
                "requested_by_user": {
                    "UserCompany": {
                        "id": 1360,
                        "display_name": "Surrey Coöperatie",
                        "public_nick_name": "Surrey Coöperatie",
                        "avatar": {...},
                        "session_timeout": 604800
                    }
                },
                "granted_by_user": {
                    "UserPerson": {
                        "id": 1363,
                        "display_name": "New bunqer",
                        "public_nick_name": "New bunqer",
                        "avatar": {...},
                        "session_timeout": 604800
                    }
                }
            }
        }
    ]
}
```

* `Id`: Session ID for authentication
* `Token`: Session token for API calls
* `UserApiKey`: Information about the API key relationship between the partner (`requested_by_user`) and the provisioned user (`granted_by_user`)

Save the session ID for subsequent API calls to the provisioned user's endpoints.