Skip to main content
You can now narrow what an Auto.Complete session is allowed to do, so a leaked session token can do less.
POST /autocomplete/sessions accepts an optional scope with:
  • routes: which searches the session may run and, for each, which related data it may include or filter by. Any other search returns 403.
  • max_limit: the most suggestions a single request may ask for, up to 20.
Leave scope out and the session can search everything your key can, as before. The session response now returns the scope it was granted, plus min_query_chars (how many characters a query needs before Auto.Complete searches) and filter_rules (how long a query must be before each filter applies), so your front end can wait instead of sending a request that would be refused. The Auto.Complete SDK reads these for you from version 0.8.0. See Auto.Complete. No integration changes required. scope is optional.