Authentication and scope
Use the correct session, CSRF protection and institution/environment scope.
#Portal session
POST /portal-api/login starts a session using a username and password. The HTTPS cookie is named __Host-sigillum-session. GET /portal-api/session returns the current scope and CSRF value. Preserve same-origin checks and CSRF protection.
#Scope and mutation headers
| Header | Purpose |
|---|---|
| X-Sigillum-Csrf | Session-provided token for protected/mutating POST actions |
| X-Sigillum-Institution | Selected institution identity |
| X-Sigillum-Environment | Selected environment identity |
Headers must agree with the authorised session; they do not grant access to another institution. Use the /portal-api/scope flow and refreshed session values when changing scope.
#SDK service identity
Use the config.json generated for the service. sourceToken is service-scoped; signed entry profiles establish application context. Keep credentials out of public pages, issues and examples. Use the supplied SDK rather than manually imitating its binary delivery protocol with cURL.