API spec for sessions, users and portfolio