Verified live on 2026-10-22 against the dev server (debug build, emulator, ap.gov test user). SplashActivity opens the account-lib login screen when no Bridge account exists. The user types login name, organisation and password; the name is sent as login@@tenant. A username like user@@tenant selects BridgeAccountType.USER, whose path is /api/session/v1 (IE accounts would use /api/iesession/v1-v3; Urvi never does). BridgeSessionHelper.createSession sends a POST with no body; the credentials travel as X-USER and X-PASS headers. The session id comes back in the X-SESSIONID response header and is stored as the AccountManager auth token. Authenticator.getAuthToken repeats the same call with the password stored in AccountManager whenever the token is invalidated after a 401. {base} is bridge_base_url (dev: https://dev.platformcommons.org) or, for user@@ap.gov when federation is on, federation_url (https://ryss.ap.gov.in), followed by the techl prefix /ctld (BaseURLUtil.getBaseURLWithTechl). The URL is built as {base}/ + /ctld, so the request goes to …org//ctld/api/session/v1 with a double slash; the server accepts it.
Headers
Header
Value
Notes
X-USER
user_a@@ap.gov
Login name plus @@tenant, lower-cased.
X-PASS
<password>
Plain-text password in a request header (TLS only). Also stored in AccountManager for silent re-login.
X-APPID
109
Urvi app id on the Bridge platform (observed).
X-APPVERSION
2.2.13
versionName (observed).
X-APPKEY
<redacted: hardcoded value at app/src/{debug,release}/res/values/build_type_config.xml:7>
Fixed app key read by AppInfoManager.java:22. A shared secret shipped in the APK.
X-APPCODE
org.platformcommons.urvi
Package name; org.platformcommons.urvi.debug on debug builds (observed).
X-DEVICEID
a1b2c3d4e5f60718
16 hex characters returned by PUT /ctld/api/device/deviceid/v1 just before (observed format).
Request
No body. Credentials go in the X-USER and X-PASS headers.
Response
Example response body (synthetic data)
{
"_note": "Success: the token is the X-SESSIONID response header; the body is not read.",
"failureExample(401)": {
"errorCode": "ERR_PLATFORM_SECURITY_UNAUTHENTICATED",
"errorMessage": "Unable to process your request"
}
}
Field
Type
Required
Notes
X-SESSIONID (response header)
string
Session token. Stored as the AccountManager auth token and sent as X-SESSIONID on every later API call.
(body)
string
Read only on failure: becomes the LoginException message shown on the login screen.
Errors
Status
When
What the app does
401
Unknown user, wrong password, or a user that does not exist on this server (observed when dev users were sent to production)
The JSON body becomes the LoginException message on the login screen. Observed body: {"errorCode":"ERR_PLATFORM_SECURITY_UNAUTHENTICATED","errorMessage":"Unable to process your request"}.
device id PUT != 200
Device registration fails first
'Device registration failed'; the session call is never made.
401 on a later API call
Session expired
AuthInterceptor / CoreAPI invalidate the token; Authenticator silently calls this endpoint again with the stored password.