REST API authentication state

[webcyberrob]

Hi,

Im trying to understand where the REAST API authentication state is held. For example I can call the login action and I get a valid response, however I don't see a header or token which indicates I have authenticated for subsequent calls. Hence is it the case that the connection is treated as an authenticated connection and thus subsequent calls must be made over the same connection? The implication that authentication state is thus maintained server side?

R

[webcyberrob]

Ok - I think Ive worked it out now…the REST implementation is essentially stateless, the authentication attributes (username & password) are sent in the header with each request.

I interpreted the login API as creating an authenticated session rather than just an API to authenticate the username, password pair.

R