Manage Hosted Flow sessions

An Inquiry stores the task and result. A session grants temporary browser access to that task. Both operations below require inquiries:create and inquiries:read.

Issue a new session

POST /api/platform/v1/inquiries/{inquiryId}/resume

curl --request POST 'https://www.uat.gofa.app/api/platform/v1/inquiries/01234567-89ab-4cde-8fab-0123456789ab/resume' \
  --header "Authorization: Bearer $GOFA_API_KEY"

Use this when the customer needs another access link to an unfinished task. Verify customer ownership in your backend first. An empty body or an empty JSON object is accepted; no query parameters or other body fields are accepted.

200 OK returns data.inquiry, data.launchUrl, data.sessionId, and data.expiresAt. The original Inquiry deadline is preserved. Existing sessions remain valid unless revoked. There is a maximum of 25 sessions per Inquiry, including the initial session.

Eligible tasks are created or in_progress, without a saved result, and before their expiry. Completed and failed tasks cannot receive a new session through this endpoint (409); expired access returns 410. A participant can still retry a recoverable failed Vital Scan using their existing valid session. See Lifecycle and retries.

This operation is not idempotent: repeated successful calls issue separate sessions. Avoid automatic retry loops. It shares the creation/resume rate quota.

Revoke a session

DELETE /api/platform/v1/inquiries/{inquiryId}/sessions/{sessionId}

curl --request DELETE 'https://www.uat.gofa.app/api/platform/v1/inquiries/01234567-89ab-4cde-8fab-0123456789ab/sessions/11234567-89ab-4cde-8fab-0123456789ab' \
  --header "Authorization: Bearer $GOFA_API_KEY"

200 OK returns:

{
  "ok": true,
  "data": {
    "sessionId": "11234567-89ab-4cde-8fab-0123456789ab",
    "revoked": true
  },
  "requestId": "example-request-id"
}

An empty body or an empty JSON object is accepted. Revoking a session blocks subsequent access using that session. It does not delete the Inquiry or its saved result and does not revoke other sessions. Do not treat revocation as a refund or as a new assessment.