Onboarding Sessions

Create an onboarding session

POST/onboarding-sessions
onboarding:writecreate_onboarding_session

Starts a session and returns it with a Location. user_id must be an organisation user, not a service user, else 422 exists. A continuous flow's live real session for the user is returned with 200 instead. A real run notifies holders of the permission to view user onboarding questionnaires, not the respondent. A dry run notifies nothing. Emits onboarding_session.created; DELETE undoes it.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · OnboardingSessionCreate

  • flow_idstring (uuid)Required#

    The onboarding flow to run. A real run needs it published; an unknown flow is 422 exists.

  • user_idstring (uuid)Required#

    The user who takes the flow. It must be an organisation user, not a service user, of a type in the flow's user_types, else 422 exists or in.

  • flow_testboolean#

    True for a test run, which needs no published flow, never counts as the user's onboarding and replaces the user's earlier test runs of the flow. Defaults to false.

    Default: false
{
  "flow_id": "48e0c1a6-6f3b-4d44-9d49-0a5a0b8f2d11",
  "user_id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
  "flow_test": false
}

Responses

200

The user already has a live real session on this continuous flow. It is returned unchanged; nothing was created and no event was sent.

OnboardingSession
{
  "data": {
    "id": "3f6e1c0a-8d52-4b7e-9a14-2c5d7e9b1f60",
    "flow_id": "48e0c1a6-6f3b-4d44-9d49-0a5a0b8f2d11",
    "user_id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
    "status": "in_progress",
    "flow_test": false,
    "started_at": "2026-11-08T10:30:00Z",
    "completed_at": null,
    "verification": null,
    "created_at": "2026-11-08T10:30:00Z",
    "updated_at": "2026-11-08T10:30:00Z"
  }
}
201

The onboarding session was created.

OnboardingSession
{
  "data": {
    "id": "3f6e1c0a-8d52-4b7e-9a14-2c5d7e9b1f60",
    "flow_id": "48e0c1a6-6f3b-4d44-9d49-0a5a0b8f2d11",
    "user_id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
    "status": "in_progress",
    "flow_test": false,
    "started_at": "2026-11-08T10:30:00Z",
    "completed_at": null,
    "verification": null,
    "created_at": "2026-11-08T10:30:00Z",
    "updated_at": "2026-11-08T10:30:00Z"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/onboarding-sessions\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "flow_id": "48e0c1a6-6f3b-4d44-9d49-0a5a0b8f2d11",
  "user_id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
  "flow_test": false
}'