Session Policy Validator

identity.session_policy_validate

ProductionBounded custom (Class B)Deterministicstrictfastv1.0.0

No network

Overview

You send idleTimeoutSeconds and absoluteTimeoutSeconds from 1 through 31,536,000. rotateRefreshOnUse and detectRefreshReuse default to false. Cookie flags default to Secure true, HttpOnly true and SameSite LAX. revocationTarget defaults to SESSION and baseline to NONE. Omitting maxConcurrentSessions emits UNBOUNDED_CONCURRENCY. The call does not inspect a live session.

A session policy whose idle window outlives the absolute cap cannot be enforced consistently.

Reliability

SameSite NONE requires Secure. SESSION_POLICY_INVALID — trigger: a duration or concurrency value outside the published range; retryable: no; next: send in-range integers.

Context footprint

Derived bounds and diagnostics only. A successful call costs 1 execution credit.

When to use it

When idle, absolute and cookie flags of a session policy must be checked together.

When cookie flags must be applied to a live browser rather than checked as a document.

Scope

Note

Validates idle, absolute, rotation, cookie and concurrency session policy coherence.

Non-goals

Does not inspect a live session
Does not verify a JWT
Does not enforce the policy

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

validation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input2 MB

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
idleTimeoutSeconds	integer	Yes	Idle timeout in seconds from 1 through 31536000.
absoluteTimeoutSeconds	integer	Yes	Absolute timeout in seconds from 1 through 31536000.
rotateRefreshOnUse	boolean	No	Whether refresh tokens rotate on use. Omit it for false.
detectRefreshReuse	boolean	No	Whether refresh reuse is detected. Omit it for false.
maxConcurrentSessions	integer	No	Concurrency cap from 1 through 10001 in schema; runtime accepts at most 10000. Omit it to leave concurrency unbounded.
cookieSecure	boolean	No	Whether the session cookie requires HTTPS. Omit it for true.
cookieHttpOnly	boolean	No	Whether the session cookie is HttpOnly. Omit it for true.
cookieSameSite	string	No	STRICT, LAX or NONE. Omit it for LAX.
revocationTarget	string	No	SESSION, USER or NONE. Omit it for SESSION.
baseline	string	No	NONE, STANDARD or HIGH_ASSURANCE. Omit it for NONE.

Output schema

Field	Type	Required	Description
valid	boolean	Yes	True when no diagnostic has severity ERROR.
idleTimeoutSeconds	integer	Yes	Applied idle timeout in seconds.
absoluteTimeoutSeconds	integer	Yes	Applied absolute timeout in seconds.
effectiveIdleSeconds	integer	Yes	The smaller of idle and absolute timeouts, used as the effective idle bound.
rotateRefreshOnUse	boolean	Yes	Whether refresh tokens rotate on use.
detectRefreshReuse	boolean	Yes	Whether refresh reuse is detected.
maxConcurrentSessions	integer	No	Applied concurrency cap. Omitted from the output when the request omitted it.
cookieSecure	boolean	Yes	Whether the session cookie requires HTTPS.
cookieHttpOnly	boolean	Yes	Whether the session cookie is HttpOnly.
cookieSameSite	string	Yes	STRICT, LAX or NONE.
revocationTarget	string	Yes	SESSION, USER or NONE.
baseline	string	Yes	NONE, STANDARD or HIGH_ASSURANCE.
rulesetVersion	string	Yes	Pinned session-policy ruleset identifier.
diagnostics	array	Yes	Bounded array of 0 through 500 closed findings, each with code, severity, message, path, source and details.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"identity.session_policy_validate","input":{"idleTimeoutSeconds":600,"absoluteTimeoutSeconds":3600}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("identity.session_policy_validate", {"maxConcurrentSessions":5,"absoluteTimeoutSeconds":3600,"idleTimeoutSeconds":600});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.
SESSION_POLICY_INVALID	400	No	The request payload failed this skill's input validation.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not inspect a live session
Does not verify a JWT
Does not enforce the policy
Applying cookie flags in a browser
Signing a JWT

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "identity.session_policy_validate",
  "input": {
    "maxConcurrentSessions": 5,
    "absoluteTimeoutSeconds": 3600,
    "idleTimeoutSeconds": 600
  }
}

Examples

A 10-minute idle window under a one-hour cap is valid

Inputjson

{
  "maxConcurrentSessions": 5,
  "absoluteTimeoutSeconds": 3600,
  "idleTimeoutSeconds": 600
}

Expected outputjson

{
  "rotateRefreshOnUse": false,
  "revocationTarget": "SESSION",
  "cookieSameSite": "LAX",
  "rulesetVersion": "identity.session_policy.v1",
  "effectiveIdleSeconds": 600,
  "cookieHttpOnly": true,
  "baseline": "NONE",
  "detectRefreshReuse": false,
  "diagnostics": [],
  "idleTimeoutSeconds": 600,
  "maxConcurrentSessions": 5,
  "cookieSecure": true,
  "valid": true,
  "absoluteTimeoutSeconds": 3600
}

Tip

valid is true and effectiveIdleSeconds is 600.

An idle timeout larger than the absolute timeout is invalid