Setup and Authentication

Before you send requests to Vistar APIs (application programming interface), you must create a dedicated API user for each account and environment you want to access. Use the API user’s credentials to get a session token and include the token in subsequent requests. This topic explains the setup, authentication process, and connection requirements.

In this topic, you'll learn about:

• Dedicated API user setup.
• Session-based authentication.
• Vistar's session requirements and encryption standards.

Before you can use Vistar’s APIs, authenticate with a dedicated API user, similar to a service account, to get a session token. This securely limits your requests to the correct account and environment.

For each account you plan to access through the API, you must create a dedicated user with the API Access role enabled.

• Use this user ONLY for API access.
• A user is tied to one account and one environment. If you work across multiple accounts or across Staging and Production, create separate users for each.
• When you set up the user in Admin, select API Access. To learn about creating a new user, see the DSP Users Management or SSP Users Management topics.
• Sessions are valid for 8 hours. Reuse your session token across requests rather than creating a new session each time.

Vistar’s APIs use session-based authentication. To start an authenticated session, call the session endpoint using your API user’s login credentials (username and password). The API returns a Set-Cookie header containing your session token.

Include the session token in the Cookie header of each subsequent request. Some HTTP (Hypertext Transfer Protocol) clients manage session cookies automatically. If yours doesn’t, store the token and add it to the Cookie header manually.

The following example shows how to start a session and authenticate a subsequent request.

Send your API user's credentials to the session endpoint:

POST https://platform-api.vistarmedia.com/api/session

{
  "email": "username",
  "password": "mypassword"
}

The API returns the session token in the Set-Cookie response header:

HTTP/1.1 200 OK
Date: Fri, 01 Aug 2025 14:45:45 GMT
Content-Type: application/json
Set-Cookie: tr-production=eyJfcGVybWFuZW50Ijp0cnV1LCJ1c2VyLmlkIjoiSkxPRklwOUJUOVNidFFvNXU1Q1J0USIsInVzZXIuaXNfYWRtaW4i0mZhbHN1fQ.G25kmQ.TIUV2Zvlm3dq5Ss193mlKchG2QU; Domain=.vistarmedia.com; Expires=Fri, 01-Aug-2025 22:45:45 GMT; Secure: HttpOnly: Path=/

Include the session token in the Cookie request header:

GET https://platform-api.vistarmedia.com/api/ssp/v1/advertisers/000lYW0SSFSPuV32udyVpA

Cookie: tr-production=eyJfcGVybWFuZW50Ijp0cnVlLCJ1c2VyLmlkIjoiSkxPRklwOUJUOVNidFFvNXU1QlJ0USIsInVzZXIuaXNfYWRtaW4iOmZhbHNlfQ.G25kmQ.TIUV2Zvlm3dq5Ssl93mlKchG2QU

To protect data in transit, Vistar's APIs enforce the following connection requirements:

• Use HTTPS with TLS (Transport Layer Security) only.
• Use TLS versions: 1.2 or 1.3.
• Use one of the following supported cipher suites:
  • TLS_AES_128_GCM_SHA256
  • TLS_AES_256_GCM_SHA384
  • TLS_CHACHA20_POLY1305_SHA256
  • ECDHE-RSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES128-SHA256
  • ECDHE-RSA-AES256-GCM-SHA384
  • ECDHE-RSA-AES256-SHA384
• Use HTTP/1.1 or HTTP/2.

These requirements help ensure your API integration meets modern security standards—protecting your data and your users.