> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Start a hosted enrollment session > Starts a session for one applicant on a customer journey you built and published in Console, and returns the `embed_url` where the applicant completes it. Call it from your server: the response carries a secret session token. A journey that was never published answers 409. When the session completes, the `OnboardingSession.completed` webhook fires and `GET /onboarding/sessions/{session_id}/results` returns the outcome. This is a hosted enrollment session: the applicant completes your published journey on Baselayer's page. To verify an identity you collected yourself, use a direct verification, `POST /issuance/identities/verifications`. Onboarding must be enabled for your organization. Until it is, this endpoint answers 403 with error code 37. ## OpenAPI ````yaml /api-reference/openapi.json post /onboarding/sessions openapi: 3.1.0 info: title: baselayer-api-service version: 0.1.0 servers: - url: https://api.baselayer.com/ security: [] paths: /onboarding/sessions: post: tags: - Onboarding summary: Start a hosted enrollment session description: >- Starts a session for one applicant on a customer journey you built and published in Console, and returns the `embed_url` where the applicant completes it. Call it from your server: the response carries a secret session token. A journey that was never published answers 409. When the session completes, the `OnboardingSession.completed` webhook fires and `GET /onboarding/sessions/{session_id}/results` returns the outcome. This is a hosted enrollment session: the applicant completes your published journey on Baselayer's page. To verify an identity you collected yourself, use a direct verification, `POST /issuance/identities/verifications`. Onboarding must be enabled for your organization. Until it is, this endpoint answers 403 with error code 37. operationId: create_onboarding_session_onboarding_sessions_post requestBody: content: application/json: schema: $ref: '#/components/schemas/v1.CreateOnboardingSessionRequest' required: true responses: '201': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/v1.CreateOnboardingSessionResponse' '403': description: >- Onboarding is not enabled for the organization (code 37), or the credential lacks the onboarding permission this endpoint needs (code 30). content: application/json: schema: anyOf: - $ref: '#/components/schemas/APIError' title: ForbiddenOrganizationNotEnrolled description: >- Forbidden access. The organization is not enrolled in the product this route belongs to. examples: - code: 37 message: >- Forbidden access. The organization is not enrolled in the product this route belongs to. metadata: {} - $ref: '#/components/schemas/APIError' title: ForbiddenAccessNoPermission description: >- Forbidden access. The authentication credentials don't have appropriate permissions to access or affect the resource. examples: - code: 30 message: >- Forbidden access. The authentication credentials don't have appropriate permissions to access or affect the resource. metadata: {} title: >- Response 403 Create Onboarding Session Onboarding Sessions Post '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyHeader: [] components: schemas: v1.CreateOnboardingSessionRequest: properties: template_id: type: string format: uuid title: Template Id description: >- ID of the customer journey to run, as built and published in Console; it is the last part of the journey's Console URL. The session runs the latest published version, and a journey that was never published is rejected. reference_id: anyOf: - type: string - type: 'null' title: Reference Id description: >- Your own identifier for the applicant or application, returned on the session, its results and its webhooks. additionalProperties: false type: object required: - template_id title: CreateOnboardingSessionRequest (v1) description: |- Request to start an onboarding session for one applicant. Call it from your server; the applicant completes the flow at the returned ``embed_url``. v1.CreateOnboardingSessionResponse: properties: id: type: string format: uuid title: Id description: >- Onboarding session id. Use it to fetch results and to match `OnboardingSession` webhooks. session_token: type: string title: Session Token description: >- Secret token that lets the applicant's browser drive this session. Returned only once and already embedded in `embed_url`; treat it as a credential. embed_url: type: string title: Embed Url description: >- URL of the hosted flow for this session. Open it for the applicant or load it in an iframe. expires_at: type: string format: date-time title: Expires At description: When `session_token`, and so `embed_url`, stops working. reference_id: anyOf: - type: string - type: 'null' title: Reference Id description: Caller-supplied correlation id. type: object required: - id - session_token - embed_url - expires_at title: CreateOnboardingSessionResponse (v1) description: A newly started onboarding session and the link the applicant opens. APIError: properties: code: type: integer title: Code message: type: string title: Message uri: anyOf: - type: string - type: 'null' title: Uri metadata: additionalProperties: true type: object title: Metadata request_id: anyOf: - type: string - type: 'null' title: Request Id type: object required: - code - message title: APIError description: >- APIError is a Pydantic model for standardizing error responses from the API. This class is used internally by APIException for JSON serialization. Users should typically work with APIException directly in exception catalogs. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: APIKeyHeader: type: apiKey in: header name: X-API-Key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.