---
title: "Create a new detect liveness session."
method: POST
path: "/detectLiveness-sessions"
---

# Create a new detect liveness session.

`POST /detectLiveness-sessions`

A session is best for client device scenarios where developers want to authorize a client device to perform only a liveness detection without granting full access to their resource. Created sessions have a limited life span and only authorize clients to perform the desired action before access is expired.

Permissions includes...
>
*
  * A token lifetime of 10 minutes.

> [!NOTE]
> Client access can be revoked by deleting the session using the Delete Liveness Session operation. To retrieve a result, use the Get Liveness Session. To audit the individual requests that a client has made to your resource, use the List Liveness Session Audit Entries.

## Request body

- CreateLivenessSessionContent — Request model for creating liveness session.
  - `livenessOperationMode` 'Passive' | 'PassiveActive', required — The liveness operation mode to drive the client's end-user experience.
  - `deviceCorrelationIdSetInClient` boolean — Whether or not to allow client to set their own 'deviceCorrelationId' via the Vision SDK. Default is false, and 'deviceCorrelationId' must be set in this request body.
  - `enableSessionImage` boolean — Whether or not store the session image.
  - `livenessModelVersion` '2024-11-15' — The model version used for liveness classification.
  - `deviceCorrelationId` string — Unique Guid per each end-user device. This is to provide rate limiting and anti-hammering. If 'deviceCorrelationIdSetInClient' is true in this request, this 'deviceCorrelationId' must be null.
  - `authTokenTimeToLiveInSeconds` integer — Seconds the session should last for. Range is 60 to 86400 seconds. Default value is 600.
  - `numberOfClientAttemptsAllowed` object — The number of times a client can attempt a liveness check using the same authToken. Default value is 1. Maximum value is 3.
  - `userCorrelationId` string — Unique Guid per each end-user. This is to provide rate limiting and anti-hammering. If 'userCorrelationIdSetInClient' is true in this request, this 'userCorrelationId' must be null.
  - `userCorrelationIdSetInClient` boolean — Whether or not to allow client to set their own 'userCorrelationId' via the Vision SDK. Default is false, and 'userCorrelationId' must be set in this request body.
  - `expectedClientIpAddress` string — Specify the expected IP address or CIDR block of the client that runs the liveness check.

## Response `200`

A successful call create a session for a client device and provide an authorization token for use by the client application for a limited purpose and time.

- LivenessSession — Session result of detect liveness.
  - `sessionId` string, required — The unique ID to reference this session.
  - `authToken` string, required — Bearer token to provide authentication for the Vision SDK running on a client application. This Bearer token has limited permissions to perform only the required action and expires after the TTL time. It is also auditable.
  - `status` 'NotStarted' | 'Running' | 'Succeeded' | 'Failed' | 'Canceled', required — Enum describing allowed operation states.
  - `modelVersion` '2024-11-15' — The model version used for liveness classification.
  - `isAbuseMonitoringEnabled` object — Denotes if the abuse monitoring feature was enabled during this session.
  - `expectedClientIpAddress` string — The expected IP address or CIDR block of the client that runs the liveness check.
  - `results` LivenessSessionResults, required — The results of the liveness session.
    - `attempts` LivenessSessionAttempt[], required — The attempts data of underlying liveness call with the session.
      - `attemptId` integer, required — The attempt ID, start from 1.
      - `attemptStatus` 'NotStarted' | 'Running' | 'Succeeded' | 'Failed' | 'Canceled', required — Enum describing allowed operation states.
      - `result` LivenessResult — The results of the liveness classification.
        - `livenessDecision` 'uncertain' | 'realface' | 'spoofface' — The outcome of the liveness classification.
        - `targets` LivenessDecisionTargets, required — The targets used for liveness classification.
          - `color` LivenessColorDecisionTarget, required — The target from color image used for liveness classification.
            - `faceRectangle` FaceRectangle, required — A rectangle within which a face can be found.
              - …
        - `digest` string, required — The server calculated digest for this request. If the client reported digest differs from the server calculated digest, then the message integrity between the client and service has been compromised and the result should not be trusted. For more information, see how to guides on how to leverage this value to secure your end-to-end solution.
        - `sessionImageId` string — The image ID of the session request.
      - `error` LivenessError — The error of the liveness classification.
        - `code` string, required — The error code.
        - `message` string, required — The error message.
        - `targets` LivenessDecisionTargets, required — The targets used for liveness classification.
          - `color` LivenessColorDecisionTarget, required — The target from color image used for liveness classification.
            - `faceRectangle` FaceRectangle, required — A rectangle within which a face can be found.
              - …
      - `clientInformation` ClientInformation[] — The client information gathered during the liveness attempt.
        - `ip` string, required — The client ip address seen during the liveness attempt.
      - `abuseMonitoringResult` AbuseMonitoringResult — The abuse monitoring result for the liveness attempt.
        - `isAbuseDetected` object, required — Denotes if abuse detection triggered during this liveness attempt.
        - `otherFlaggedSessions` OtherFlaggedSessions[], required — Denotes if abuse detection triggered during this liveness attempt.
          - `attemptId` integer, required — The attempt ID, start from 1.
          - `sessionId` string, required — The unique session ID of the flagged session.
          - `sessionImageId` string — The image ID from the flagged session.

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/azure/apis/ai-face.md) · [All operations](https://skmtc.net/azure/apis/ai-face/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/ai-face/versions/e9a68c525be6/schema)