Set guardian-managed session permissions
Updates the permissions on a session that a guardian is allowed to manage. Permissions the product does not expose to guardians are ignored rather than rejected, so a request may legitimately change fewer permissions than it names. The response is the resulting permission set — read it back rather than assuming the request applied verbatim.
Authorization
api-key In: header
Request Body
application/json
Update session permissions request
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/session/set-guardian-managed-permissions" \ -H "Content-Type: application/json" \ -d '{ "sessionId": "b1a6482d-5242-4b4a-aa88-3fa52595a672", "enabledPermissions": [ "text-chat-public", "text-chat-private" ] }'{ "status": "PASS", "session": { "sessionId": "b1a6482d-5242-4b4a-aa88-3fa52595a672", "permissions": [ { "name": "text-chat-public", "enabled": false, "managedBy": "GUARDIAN" } ] }}{ "error": "NOT_FOUND", "errorMessage": "Session not found"}Get session GET
Returns a previously created session, identified by `sessionId` or by `kuid` together with the product. Pass `etag` to make the read conditional: the session is returned only if it changed since the etag was issued, and an unchanged session responds `NOT_MODIFIED` instead. Poll with the etag rather than refetching the whole session. An `ACTIVE` status means the player meets the product's requirements, and the response carries the permissions in force for them. The etag covers the whole rendered response, including the `permissions`, `ageStatus` and `ageCategory` derived from your product and jurisdiction configuration — so a configuration change moves the etag even when the session itself did not change.
Unlink a parent from a session POST
Unlinks a parent from a player session that was previously linked via the `/invite-parent` flow. On success the call wipes any parent-set preferences on the session and fires the `Session.Unlink` webhook. Permissions and existing player data are left intact. The endpoint is idempotent on `sessionId`. A second call after the link is already removed returns 200 with the original `unlinkedAt`.