> ## Documentation Index
> Fetch the complete documentation index at: https://docs.server.express/llms.txt
> Use this file to discover all available pages before exploring further.

# Redeem a console ticket and redirect to the KVM

> Opened in a new browser tab, so it takes no Authorization header — the ticket is the credential. Tickets are single
use, valid for 60 seconds, and minted by POST /v1/dedicated/{id}/console for one person and one server. Access
(operate role, manageable billing status) is checked again on redemption. On success it asks TenantOS for a console
session and answers 302 to it with `Cache-Control: no-store` and `Referrer-Policy: no-referrer`. Every failure is a
short plain-text sentence, not JSON.



## OpenAPI

````yaml /api-reference/openapi.yaml get /v1/dedicated/console/go/{ticket}
openapi: 3.1.0
info:
  title: Server.Express API
  version: 1.0.0
  description: >-
    The customer-facing Server.Express API: auth, billing, tickets, cloud and
    dedicated servers, hosting, reselling and account management. Every response
    uses the `{ success, data | error }` envelope.
  contact:
    name: Server.Express
    url: https://server.express
servers:
  - url: https://my.server.express/api
    description: Production
security:
  - bearerAuth: []
  - apiToken: []
tags:
  - name: API Tokens
  - name: Account
  - name: Auth
  - name: Cloud
  - name: Coupons
  - name: Credits
  - name: Dashboard
  - name: Dedicated
  - name: Health
  - name: Hosting
  - name: Integrations
  - name: Invoices
  - name: Livechat
  - name: Notifications
  - name: Passkeys
  - name: Payments
  - name: Products
  - name: Public
  - name: Public Invoices
  - name: Public Tools
  - name: Reseller
  - name: SSH Keys
  - name: Services
  - name: Tasks
  - name: Teams
  - name: Tickets
  - name: Web Hosting
  - name: Webhooks
paths:
  /v1/dedicated/console/go/{ticket}:
    get:
      tags:
        - Dedicated
      summary: Redeem a console ticket and redirect to the KVM
      description: >-
        Opened in a new browser tab, so it takes no Authorization header — the
        ticket is the credential. Tickets are single

        use, valid for 60 seconds, and minted by POST /v1/dedicated/{id}/console
        for one person and one server. Access

        (operate role, manageable billing status) is checked again on
        redemption. On success it asks TenantOS for a console

        session and answers 302 to it with `Cache-Control: no-store` and
        `Referrer-Policy: no-referrer`. Every failure is a

        short plain-text sentence, not JSON.
      operationId: publicDedicatedRedeemConsoleTicket
      parameters:
        - name: ticket
          in: path
          required: true
          description: The console ticket from POST /v1/dedicated/{id}/console.
          schema:
            type: string
      responses:
        '302':
          description: Redirect to the live TenantOS console session.
          headers:
            Location:
              schema:
                type: string
                format: uri
            Cache-Control:
              schema:
                type: string
                const: no-store
            Referrer-Policy:
              schema:
                type: string
                const: no-referrer
        '403':
          description: >-
            You no longer have operate access to this server, or it's pending or
            suspended.
          content:
            text/plain:
              schema:
                type: string
        '410':
          description: The ticket has expired or has already been used.
          content:
            text/plain:
              schema:
                type: string
        '500':
          description: Unexpected server error.
          content:
            text/plain:
              schema:
                type: string
        '502':
          description: >-
            TenantOS couldn't start the console, or answered without an http(s)
            URL.
          content:
            text/plain:
              schema:
                type: string
      security: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh.
        A session satisfies every API scope.
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: se_live_<prefix>_<secret>
      description: >-
        Personal API token created under Settings → API tokens. Only routes
        guarded by verifyApiAuth accept it, and the token must carry the scope
        named in the operation's x-required-scope.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.