> ## Documentation Index > Fetch the complete documentation index at: https://docs.server.express/llms.txt > Use this file to discover all available pages before exploring further. # Open a web shell session > Verifies a second-factor code (TOTP or backup code) — required every time — checks the guest agent is reachable, starts a pty on the VM and mints a 30-minute session. Connect a WebSocket to `path` on the API origin. Linux only. Session auth only; needs the operate role. 403 while PENDING/SUSPENDED; 401 on a wrong code (audited as `WEBSHELL_DENIED`); 409 if two-factor isn't enabled, the OS is Windows, the guest agent can't be reached, or the guest lacks `script` (util-linux). Writes a `WEBSHELL_OPEN` audit entry on success. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/cloud/{id}/webshell/session openapi: 3.1.0 info: title: Server.Express API version: 1.0.0 description: >- The customer-facing Server.Express API: auth, billing, tickets, cloud and dedicated servers, hosting, reselling and account management. Every response uses the `{ success, data | error }` envelope. contact: name: Server.Express url: https://server.express servers: - url: https://my.server.express/api description: Production security: - bearerAuth: [] - apiToken: [] tags: - name: API Tokens - name: Account - name: Auth - name: Cloud - name: Coupons - name: Credits - name: Dashboard - name: Dedicated - name: Health - name: Hosting - name: Integrations - name: Invoices - name: Livechat - name: Notifications - name: Passkeys - name: Payments - name: Products - name: Public - name: Public Invoices - name: Public Tools - name: Reseller - name: SSH Keys - name: Services - name: Tasks - name: Teams - name: Tickets - name: Web Hosting - name: Webhooks paths: /v1/cloud/{id}/webshell/session: post: tags: - Cloud summary: Open a web shell session description: >- Verifies a second-factor code (TOTP or backup code) — required every time — checks the guest agent is reachable, starts a pty on the VM and mints a 30-minute session. Connect a WebSocket to `path` on the API origin. Linux only. Session auth only; needs the operate role. 403 while PENDING/SUSPENDED; 401 on a wrong code (audited as `WEBSHELL_DENIED`); 409 if two-factor isn't enabled, the OS is Windows, the guest agent can't be reached, or the guest lacks `script` (util-linux). Writes a `WEBSHELL_OPEN` audit entry on success. operationId: publicCloudOpenWebShell parameters: - name: id in: path required: true description: Service id of the cloud server. schema: type: string format: uuid requestBody: required: true content: application/json: schema: type: object required: - code properties: code: type: string description: TOTP code or backup code. cols: type: integer default: 80 description: Initial terminal width. rows: type: integer default: 24 description: Initial terminal height. responses: '200': description: Session opened. content: application/json: schema: type: object required: - success - data properties: success: type: boolean const: true data: type: object required: - sessionId - token - expiresInMs - path properties: sessionId: type: string token: type: string description: Session secret; also embedded in `path`. expiresInMs: type: integer path: type: string description: >- WebSocket path on the API origin, `/v1/cloud/webshell/ws?session=…&token=…`. '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '500': $ref: '#/components/responses/ServerError' '503': description: The server hasn't been built yet. Retry later. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: responses: BadRequest: description: Validation failed or the request is malformed. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing, invalid or expired credentials. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Authenticated but not allowed (missing scope, not an admin, or not your resource). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: The resource doesn't exist or isn't visible to you. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Conflict: description: The request conflicts with the resource's current state. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServerError: description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' schemas: ErrorResponse: type: object required: - success - error properties: success: type: boolean const: false error: type: string description: Human-readable error message. additionalProperties: true securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh. A session satisfies every API scope. apiToken: type: http scheme: bearer bearerFormat: se_live__ description: >- Personal API token created under Settings → API tokens. Only routes guarded by verifyApiAuth accept it, and the token must carry the scope named in the operation's x-required-scope. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.