canonical: https://jentic.com/apis/whapi.com/sessions-api

# Whapi Sessions API

The William Hill Sessions API uses a central authentication service (CAS*) on all resources that require access to a customer’s account or betting functionality. To authenticate, you’ll need to supply a sportsbook username and password, in return you will be given an authentication ticket, which you can use on the majority of requests found within our services. <br /><br /><br /> The Sessions API . The API exposes 4 endpoints.

## For AI agents

Programmatically logs in a customer and obtains an authentication ticket., checks the validity of a session ticket.. Covers 4 operations.

## Scope

Does not handle payments, communications, or crm - use for identity and authentication only.

## Capabilities

- Logs in a customer and obtains an authentication ticket.
- Checks the validity of a session ticket.
- Log out a customer.
- Obtains a one-time Service Ticket that can be used to access other William Hill
- Monitor Sessions API operational status and events

## Use cases

### Identity and Authentication Operations

Use the Sessions API to perform identity auth operations programmatically. The API provides 4 endpoints covering core functionality including logs in a customer and obtains an authentication ticket., checks the validity of a session ticket., log out a customer..

Example prompt: Call POST /tickets to logs in a customer and obtains an authentication ticket.

### Automated Tickets Management

Automate tickets operations by combining multiple Sessions API endpoints. Agents can checks the validity of a session ticket. and then log out a customer. in a single workflow.

Example prompt: Call GET /tickets/{tgt} to checks the validity of a session ticket., then verify the result

### AI Agent Integration via Jentic

AI agents discover and call Sessions API endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle none tokens manually.

Example prompt: Search Jentic for 'logs in a customer and obtains an authentication ticket.', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /tickets | Logs in a customer and obtains an authentication ticket. |
| GET | /tickets/{tgt} | Checks the validity of a session ticket. |
| DELETE | /tickets/{tgt} | Log out a customer. |
| GET | /tickets/{tgt}/serviceTicket | Obtains a one-time Service Ticket that can be used to access other William Hill |

## Key resources

- **Tickets** — Operations for tickets

## Why Jentic

- **Setup:** Wiring this Sessions API by hand means pointing requests at its sandbox.whapi.com host, wiring the ticket lifecycle calls, and handling retries yourself. Through Jentic you install once, import the Sessions API from the API Directory, and your agent calls it.
- **Permission scoping:** This Sessions API puts the ticket id in the URL path (/tickets/{tgt}), so a rule can pin your agent to one ticket: it can read that ticket or request its service ticket and nothing else. You choose the operations it may call, so deleting a ticket is not included unless you add it.
- **Credential handling:** This Sessions API declares no authentication in its spec, so there is no credential to store; if your instance later adds one, Jentic One stores it once, encrypted, and injects it at execution time so it never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'log in a customer and get a ticket' or 'get a service ticket', and Jentic returns the matching Sessions API operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0** — Alternative identity auth API
- **Okta** — Alternative identity auth API

## FAQ

### What authentication does the Sessions API use?

The Sessions API uses no authentication. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I logs in a customer and obtains an authentication ticket. with the Sessions API?

Yes. Use the POST /tickets endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the Sessions API?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I logs in a customer and obtains an authentication ticket. through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'logs in a customer and obtains an authentication ticket.'. Jentic returns the matching Sessions API operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the Sessions API have?

The Sessions API exposes 4 endpoints covering tickets operations.

### Can I limit what my agent is allowed to do with the Sessions API?

Yes. Jentic One is self-hosted, so your own rules decide which Sessions API operations the agent may call and which credentials it may use. Because this API puts the ticket id in the URL path (/tickets/{tgt}), you can pin the agent to a single ticket and allow only reading that ticket (GET /tickets/{tgt}) or requesting its service ticket (GET /tickets/{tgt}/serviceTicket), while leaving out logout (DELETE /tickets/{tgt}) or login (POST /tickets) unless you explicitly add them.