> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.arb.inc/llms.txt
> Use this file to discover all available pages before exploring further.

# Attach roles to session

> Attaches user roles to the current session for authorization by validating a TOTP passcode. Roles remain attached until the session expires.



## OpenAPI

````yaml api-reference/auth.yaml post /sessions/attach-roles
openapi: 3.0.3
info:
  title: auth
  description: >-
    The Auth Service is the single source of truth for all accounts and their
    permissions, managing authentication and access control across the platform.
    It maintains efficiency at scale by issuing access tokens to accounts when
    they log into the platform and providing public keys for other services to
    verify them.
  version: 1.0.0
servers:
  - url: https://auth.platform.arb.inc
security: []
tags:
  - name: /
  - name: authenticate
  - name: internal
  - name: organizations
  - name: sessions
  - name: users
paths:
  /sessions/attach-roles:
    post:
      tags:
        - sessions
      summary: Attach roles to session
      description: >-
        Attaches user roles to the current session for authorization by
        validating a TOTP passcode. Roles remain attached until the session
        expires.
      operationId: attachSessionRoles
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - totpPasscode
              properties:
                totpPasscode:
                  type: string
                  description: Time-based one-time password for verification
                  example: '123456'
      responses:
        '200':
          description: Session roles successfully enabled
        '403':
          description: Passcode is invalid
        '409':
          description: TOTP is not configured
        '422':
          description: User has been locked out for security purposes
      security:
        - bearerAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      description: access token
      scheme: bearer
      bearerFormat: JWT

````