> ## Documentation Index
> Fetch the complete documentation index at: https://devzone.nayax.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Post Start Session

Validates the client and initializes a secure transaction session. This POST endpoint performs the initial handshake using a `TokenId` and `RandomNumber`. It returns a `Verdict` indicating if the session is approved and establishes the encryption and transaction ID context required for all subsequent operations.


## OpenAPI

````yaml /openapi/cortina.yaml post /Cortina/StartSession
openapi: 3.0.1
info:
  description: Credit Card, Prepaid, DynamicQR, StaticQR APIs
  title: Nayax Cortina API
  version: v2.1
  x-logo:
    url: https://www.nayax.com//wp-content/uploads/2015/10/logo_dark1.png
servers:
  - url: https://{domain}:{port}
    variables:
      domain:
        default: example.com
        description: Customer ID assigned by the service provider
      port:
        default: '443'
        enum:
          - '443'
          - '8443'
security: []
paths:
  /Cortina/StartSession:
    post:
      tags:
        - Cortina
      summary: Post Start Session
      requestBody:
        content:
          application/*+json:
            schema:
              $ref: '#/components/schemas/StartSessionRequest'
          application/json:
            schema:
              $ref: '#/components/schemas/StartSessionRequest'
          text/json:
            schema:
              $ref: '#/components/schemas/StartSessionRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StartSessionResponse'
            text/json:
              schema:
                $ref: '#/components/schemas/StartSessionResponse'
          description: Success
components:
  schemas:
    StartSessionRequest:
      additionalProperties: false
      properties:
        CustomData:
          $ref: '#/components/schemas/CustomData'
        DynamicURL:
          description: |
            - Optional, support different url's.
            - Length: 255
            - Actor level url configuration
          type: string
        RandomNumber:
          description: |
            Nayax will create 27 char Random Number
          type: string
        TokenId:
          description: |
            3rd party Secret Token reference number
          type: string
      type: object
    StartSessionResponse:
      additionalProperties: false
      properties:
        Status:
          $ref: '#/components/schemas/Status'
        TranIDCipher:
          description: >
            - Mandatory

            - The Integrator Generates transaction ID of 36 Chars (or 288 bits).

            - The Integrator then appends the char = and RandomNumber to create
            the ciphertext of 64 chars

            - Format TransactionId=RandomNumber

            - The integrator encrypts the ciphertexts with the Secret Token in
            AES ECB.

            - The AES key will be the last (right most) 256 bits (or 32 chars)
            of the Secret Token the matches the TokenID provided in the request.

            - Nayax will AES ECB decrypt and extract transaction id

            - The transaction Id value will then be used for all further
            requests
          type: string
      type: object
    CustomData:
      additionalProperties: false
      description: Custom Fields Information, Contact Nayax TPOC to define.
      properties:
        Actor:
          description: |
            Actor custom data (String in json format)
          example: String
          type: string
        DirectActor:
          description: |
            Direct actor custom data (String in json format)
          example: String
          type: string
        Distributor:
          description: |
            Distributor custom data (String in json format)
          example: String
          type: string
        Machine:
          description: |
            Machine custom data (String in json format)
          example: String
          type: string
        Operator:
          description: |
            Operator custom data (String in json format)
          example: String
          type: string
        SoftDecline:
          description: |
            Soft Decline custom data (String in json format)
          example: String
          type: string
      type: object
    Status:
      additionalProperties: false
      description: Transaction status
      properties:
        Code:
          description: >
            - Conditional - Only if verdict value is declined

            - Please refer to the Decline Reasons Code List in the relevant
            Overview section for full list of allowed decline codes
          format: int32
          type: integer
        CustomDeclineCode:
          description: >
            - Always mirrors the value of the Code field when Code is present,
            regardless of Verdict.

            - Included in all responses (Approved or Declined) whenever Code is
            present.
          format: int32
          type: integer
        StatusMessage:
          description: >
            - Optional

            - Length: 255

            - Transaction status message free text field / additional varying
            data
          type: string
        Verdict:
          description: |
            - Mandatory
            - Const string values:
            - Status of the request ('Approved'/'Declined')
          type: string
      type: object

````