> ## Documentation Index
> Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auto.Complete: Scoped Sessions

> Oct 15, 2026

You can now narrow what an Auto.Complete session is allowed to do, so a leaked session token can do less. \
`POST /autocomplete/sessions` accepts an optional `scope` with:

* `routes`: which searches the session may run and, for each, which related data it may include or filter by. Any other search returns `403`.
* `max_limit`: the most suggestions a single request may ask for, up to 20.

Leave `scope` out and the session can search everything your key can, as before. The session response now returns the `scope` it was granted, plus `min_query_chars` (how many characters a query needs before Auto.Complete searches) and `filter_rules` (how long a query must be before each filter applies), so your front end can wait instead of sending a request that would be refused. The [Auto.Complete SDK](https://docs.baselayer.com/docs/autocomplete-sdk.md) reads these for you from version 0.8.0.

See [Auto.Complete](https://docs.baselayer.com/docs/auto-complete.md). No integration changes required. `scope` is optional.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.