# sessions.acquire

`POST /api/public/v1/sessions/acquire`

Hold a profile's browser for your app — by profile_id, or by app_id + external_account_id through a binding: opens it on a fitting machine (or reuses the warm one) and returns the session with lease.generation. BUSY with holder_kind person, automation or app when someone else holds it; renew before ttl_seconds and detach when done.

- Capability: `session.start`
- Command: yes — send a `command_id`; resending the same id and body returns the stored receipt
- MCP tool: `sessions_acquire`

## Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `command_id` | body | string (uuid) | yes | Client-generated UUID for this command. Send the same id (and body) again to get the stored receipt instead of a second change; a different body under the same id is CONFLICT. |
| `holder_ref` | body | string | yes | Your stable name for this holder (worker, job); renew and detach must send the same value (min length 1, max length 120) |
| `profile_id` | body | string (uuid) | no | The profile to hold; or send app_id + external_account_id to use a binding |
| `app_id` | body | string | no | Your app's id, e.g. fb-poster |
| `external_account_id` | body | string | no | The account's id inside your app (no secrets) (min length 1, max length 200) |
| `device_id` | body | string (uuid) | no | Open on this machine; default: the least busy online machine of the profile's OS |
| `ttl_seconds` | body | integer | no | The hold lapses unless renewed within this many seconds (min 30, max 600) Default: `120`. |
| `keep_warm_seconds` | body | integer | no | Seconds the browser stays open after you let go, so the next acquire is instant (0 = stop as soon as the hold ends) (min 0, max 1800) Default: `120`. |

## Response

`201` with `{ data, replayed: false, correlation_id }` the first time; `200` with `replayed: true` for a repeated `command_id`.

| Field | Type | Always present | Description |
|---|---|---|---|
| `data` | object | yes |  |
| `data.id` | string (uuid) | yes |  |
| `data.lifecycle` | "queued" \| "preflight" \| "starting" \| "ready" \| "quiescing" \| "stopping" \| "closed" \| "failed" \| … | yes |  |
| `data.control` | "free" \| "reserved" \| "controlled" \| "handoff_pending" \| "revoked" \| "uncertain" | yes |  |
| `data.connectivity` | "connected" \| "reconnecting" \| "offline" \| "unknown" | yes |  |
| `data.network` | "unchecked" \| "checking" \| "healthy" \| "unhealthy" \| "unknown" | yes |  |
| `data.sync` | "clean" \| "dirty" \| "snapshotting" \| "upload_pending" \| "committing" \| "committed" \| "conflict" \| "failed" | yes |  |
| `data.fence` | integer | yes | Increments every time the profile is opened; stale reports carry an older fence (min -9007199254740991, max 9007199254740991) |
| `data.revision` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.headless` | boolean | yes |  |
| `data.profile` | object | yes |  |
| `data.profile.id` | string (uuid) | yes |  |
| `data.profile.os` | "windows" \| "linux" | yes |  |
| `data.profile.name` | string | yes |  |
| `data.profile.number` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.profile.group_id` | string (uuid) \| null | yes |  |
| `data.profile.revision` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.device` | object | yes |  |
| `data.device.id` | string (uuid) | yes |  |
| `data.device.os` | "windows" \| "linux" | yes |  |
| `data.device.name` | string | yes |  |
| `data.device.state` | string | yes |  |
| `data.device.freshness` | string | yes |  |
| `data.lease` | object | yes | Your app's hold (here `lease` is the app hold, not the machine's) |
| `data.lease.session_id` | string (uuid) | yes |  |
| `data.lease.app_id` | string | yes |  |
| `data.lease.binding_id` | string (uuid) \| null | no |  |
| `data.lease.holder_ref` | string | yes |  |
| `data.lease.generation` | integer | yes | Send with renew and detach; an older generation is FENCED (min -9007199254740991, max 9007199254740991) |
| `data.lease.state` | "active" \| "detached" \| "lapsed" \| "ended" | yes |  |
| `data.lease.ttl_seconds` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.lease.keep_warm_seconds` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.lease.acquired_at` | string (date-time) | yes |  |
| `data.lease.expires_at` | string (date-time) | yes |  |
| `data.lease.keep_warm_until` | string (date-time) | no |  |
| `data.lease.ended_reason` | string | no |  |
| `data.egress` | object \| null | yes |  |
| `data.egress.ip` | string | yes |  |
| `data.egress.checked_at` | string (date-time) | yes |  |
| `data.process` | object \| null | yes |  |
| `data.process.pid` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.runtime` | object \| null | yes |  |
| `data.runtime.channel` | string | yes |  |
| `data.runtime.version` | string | yes |  |
| `data.identity` | object \| null | yes | What the browser actually reported (user agent, languages, timezone, …) |
| `data.mismatches` | array<object> | yes |  |
| `data.remote` | object \| null | yes |  |
| `data.proxy_id` | string (uuid) \| null | yes |  |
| `data.run_id` | string (uuid) \| null | yes |  |
| `data.run_target_id` | string (uuid) \| null | yes |  |
| `data.started_by` | string \| null | yes |  |
| `data.stopped_by` | string \| null | yes |  |
| `data.stop_reason` | string \| null | yes |  |
| `data.reason_code` | string \| null | yes |  |
| `data.network_reason` | string \| null | yes |  |
| `data.ready_ms` | integer \| null | yes |  |
| `data.ready_at` | string (date-time) \| null | yes |  |
| `data.closed_at` | string (date-time) \| null | yes |  |
| `data.created_at` | string (date-time) | yes |  |
| `data.updated_at` | string (date-time) | yes |  |
| `data.attach_open` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.pending_changes` | boolean | yes |  |
| `data.profile_revision` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.acquired` | "opened" \| "reused" \| "renewed" | yes | opened a new browser, reused one already open, or renewed your own current hold |
| `correlation_id` | string (uuid) | yes |  |
| `replayed` | boolean | no | true when this command_id was already applied and the stored receipt came back |

New fields can appear at any time; ignore the ones you do not know.

## Errors

| Code | HTTP | Retryable |
|---|---|---|
| `UNAUTHENTICATED` | 401 | no |
| `FORBIDDEN` | 403 | no |
| `RATE_LIMITED` | 429 | yes |
| `VALIDATION_FAILED` | 422 | no |
| `CONFLICT` | 409 | no |
| `OUTCOME_UNKNOWN` | 202 | yes |
| `BUSY` | 409 | yes |
| `DEPENDENCY_UNAVAILABLE` | 503 | yes |
| `UNKNOWN` | 500 | no |

## Example (curl)

```bash
curl -X POST "https://browlix.com/api/public/v1/sessions/acquire" \
  -H "Authorization: Bearer $BROWLIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"command_id":"<uuid>","holder_ref":"<holder_ref>"}'
```

## Example (TypeScript SDK)

```ts
import { Browlix } from "@browlix/sdk";

const bx = new Browlix({ apiKey: process.env.BROWLIX_API_KEY! });
const reply = await bx.call("sessions.acquire", { body: {"holder_ref":"<holder_ref>"} });
console.log(reply.data);
```

## Example (Python)

```python
import os, uuid
import requests

r = requests.post(
    "https://browlix.com/api/public/v1/sessions/acquire",
    headers={"Authorization": f"Bearer {os.environ['BROWLIX_API_KEY']}"},
    json={"command_id":str(uuid.uuid4()),"holder_ref":"<holder_ref>"},
    timeout=60,
)
print(r.status_code, r.json())
```

## Example (MCP)

```json
{
  "method": "tools/call",
  "params": {
    "name": "sessions_acquire",
    "arguments": {
      "holder_ref": "<holder_ref>"
    }
  }
}
```