api/session request spec