> ## Documentation Index > Fetch the complete documentation index at: https://docs.0xmonaco.com/llms.txt > Use this file to discover all available pages before exploring further. # Create delegated session > Exchange the agent's session for an owner-scoped delegated session. The agent authenticates with its own session key, then calls this with the `owner_user_id` it wants to act for (discover it via `ListDelegatedAgentOwners`) and a freshly generated session public key. The new session acts as the owner but records the agent's address for policy enforcement. Requires an active delegation for the (owner, agent) pair, and, when the delegation has an IP allowlist, a caller address inside it. Session expiry is bounded by the delegation expiry. Every authenticated request and periodic WebSocket session revalidation requires the backing delegation to remain active and unexpired. ## OpenAPI ````yaml /proto-openapi/api/openapi.yaml post /api/v1/delegated-agents/sessions openapi: 3.0.3 info: title: Monaco Protocol API description: REST API for the Monaco Protocol hybrid CLOB exchange. version: 1.0.0 servers: - url: https://staging.apimonaco.xyz description: Staging server (Testnet) security: [] tags: - name: AccountsService - name: ApplicationsService - name: AuthService - name: BuildercodeRewardsService - name: CopyTradingService - name: DelegatedAgentsService - name: FaucetService - name: FeesService - name: HealthService - name: ManagedMarketsService description: |- Wallet-authenticated maker assignments. The signed session must match both configured maker user and application. Owner IDs are process fences, never auth. Only wallet sessions are supported; delegated-agent sessions receive 403. - name: MarginAccountsService description: |- Current public isolated-margin semantics: - a user has one parent margin account per application scope - opening orders create or reuse isolated position buckets under that parent - parent account creation is handled internally by margin workflows - name: MarketService - name: OrderbookService - name: OrdersService - name: PositionsService description: |- Current public isolated-margin semantics: - positions link to a parent margin account and, when applicable, a bucket id - opening orders create or reuse isolated position buckets under the parent - users can open another isolated position by reusing the parent account with a different market bucket - name: PulseService - name: SweeperService - name: TraderCodeService - name: TradesService - name: WhitelistService - name: WithdrawalsService paths: /api/v1/delegated-agents/sessions: post: tags: - DelegatedAgentsService - DelegatedAgents summary: Create delegated session description: |- Exchange the agent's session for an owner-scoped delegated session. The agent authenticates with its own session key, then calls this with the `owner_user_id` it wants to act for (discover it via `ListDelegatedAgentOwners`) and a freshly generated session public key. The new session acts as the owner but records the agent's address for policy enforcement. Requires an active delegation for the (owner, agent) pair, and, when the delegation has an IP allowlist, a caller address inside it. Session expiry is bounded by the delegation expiry. Every authenticated request and periodic WebSocket session revalidation requires the backing delegation to remain active and unexpired. operationId: create_delegated_session requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateDelegatedSessionRequest' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/CreateDelegatedSessionResponse' '400': description: Invalid request '401': description: Authentication required '403': description: No active delegation for owner '500': description: Internal server error security: - monacoSignature: [] - monacoHttpSignature: [] components: schemas: CreateDelegatedSessionRequest: type: object properties: ownerUserId: example: 123e4567-e89b-12d3-a456-426614174000 type: string description: >- Owner account UUID to act on behalf of (discover via ListDelegatedAgentOwners) format: uuid nullable: true sessionPublicKey: type: string description: >- Lowercase-hex (64 chars) ed25519 public key the agent generated for this delegated session. Subsequent requests acting on the owner's behalf are signed with the matching private key. nullable: true CreateDelegatedSessionResponse: type: object properties: expiresAt: example: '1735689599' type: string description: >- Session expiry as a Unix timestamp (seconds), bounded by the delegation expiry when set. Earlier revocation or policy expiry also ends access. nullable: true delegationId: type: string description: Delegation UUID for the active (owner, agent) pair format: uuid nullable: true ownerUserId: type: string description: Owner account UUID the session acts on behalf of format: uuid nullable: true agentAddress: type: string description: Agent wallet address recorded on the session for policy enforcement nullable: true securitySchemes: monacoSignature: type: apiKey description: >- Ed25519 session-key request signing. Every authenticated request carries three headers: `X-Monaco-PublicKey` (64-char lowercase-hex session public key), `X-Monaco-Timestamp` (Unix milliseconds, within 30s of server time), and `X-Monaco-Signature` (hex ed25519 signature). The signature is over `METHOD\npath?query\ntimestamp_ms\nSHA256_hex(body)`, where the body hash is the SHA-256 of the empty byte string when there is no body. Obtain the session keypair from `POST /api/v1/auth/challenge` followed by `POST /api/v1/auth/verify`. name: X-Monaco-Signature in: header monacoHttpSignature: type: apiKey description: >- RFC 9421 Ed25519 session-key request signatures. Send Signature-Input, Signature, and Content-Digest together; never combine them with X-Monaco-* credentials. The monaco signature covers @method, @path, @query, and content-digest in that order, with created (Unix seconds within 30s of server time), keyid (registered lowercase-hex session public key), and alg=ed25519 parameters. Content-Digest uses RFC 9530 sha-256 over the exact body bytes, including the empty body. Query coverage retains ordering and percent encoding. Timestamp freshness does not reject repeated identical requests; use endpoint idempotency where supported. Existing legacy signing remains supported during server-first migration; SDK RFC 9421 signing is opt-in. See https://docs.0xmonaco.com/reference/http-message-signatures for the complete profile and trust model. name: Signature in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.