Thanks.  We use them quite a bit and from what I can tell, yes the session ID is changing so I suppose I'm trying to target what even is happening that's restarting the session.  

I could understand that it might get haywire after going back and forth from the auth server, however, I'm losing my session after I've done my business with the auth server and all I'm doing is continuing to talk to the Cache server as usual.

I'm sure my issue is probably super application specific, but I thought I'd see if others had any ideas.

@Jason Jones after I posted this I forgot that @Timothy Leavitt had sent me this example of Open API generation not as an alternative to api/mgmt/v1 but as an alternative to using the package manager and the isc-rest opensource code.  

isc-ipm-js/openApiProcessor.cls at main · intersystems/isc-ipm-js (github.com)

I'm not exactly sure this answers my question about using api/mgmt/v1 to generate the spec but it could lead to some clues?  You can see the discussion here:

Projecting JSON · Discussion #22 · intersystems/isc-rest (github.com)

There's a lot to examine here but I don't think it's the simple solution we're looking for.  I personally have been sticking with the IS spec first approach as it's quite easy to implement so far.  The biggest challenge has been developing on the client side when the source code is generated on the server.  

@Heloisa Paiva 
Thanks for this great primer.

Does embedded Python support return values?  I don't see any examples here or on the IRIS documentation of class methods using embedded Python returning a value.

Also, is there a well documented source for the iris Python package?  I was following the documentation to read a global using iris.gref("^Global") to read the global from the keys and it took testing it on the API command line to find that to get a value at a global with multiple keys I had pass in something like globalRef.get(["key1","key2"]).  Not horrible to figure out but for someone used to COS it would be helpful 1) know what the iris package has in it and 2) how to use them without testing them each time.

Thank!

@Eduard Lebedyuk I get the sense that you think I'm not reading the documentation since you've linked it on this thread about three times. 

I promise, I really am trying to do my due diligence and I have been reading the online documentation, so I'm sorry if I've frustrated you.

While testing, I see I can easily set %session.Data to hold data I want to preserve.  I guess the issue I'm having boils down to how do you preserve that across REST calls?  Obviously step one is setting UseSession=1.

Using Postman I see I'm returned cookies that hold session paths and ID after making a call:

So maybe the question I'm trying to ask is, how, on my next API call can I use that session path in the cookie that may, for example, verify that a user has logged in to my system?

I understand this isn't ideal, but it's how the system work at the moment.

Without pasting a ton of code here, the basic question is can you utilize the %session variable when using /api/mgmnt/?  When UseSession is set to true, the use to %session results in error.

I'm aware that REST by definition doesn't use sessions, but our existing application does use %session for authentication and other data and the idea is to take a "first step" into REST without totally redesigning everything.

Tha said here's a small example of what I've played with:

The idea was that the client would have previously called a Login API to log the user in and setup %session.  Future API calls would use the %session variable to validate user access.  This is similar to how our web application works today.

While trying to do this I've used both my public IP address and my VPN IP address and I get the error 

Couldn't reach InterSystems IRIS at xxx.xx.x.xx:52773. One or both of your IP and Port are incorrect.

Strangely I got this to work last week without having the IAM application or user enabled.  That said I was able to access the IAM portal and set some stuff up but I'm not sure it was actually truly working.  

Any troubleshooting advice?

@Colin Brough I have found generally the message header and body data is a bit putzy to access, but not impossible.  

I'm fairly new at all of this but in the spirit of trying to be helpful: I think a business process in-between that holds on to the metadata for the message in a context object and then pass that all to a custom business operation that uses the data to generate the file name.

I am thinking though that if you are using a message router you can't send the context over, but I think if you use a call operation in the BPL you can pass in the context to the custom operation that you are calling.  You could define a rule then that picks the correct operation to route to and use indirection to call that in the BPL while passing the context.  

Someone more experienced will have to fact check me there.

@Tony Alexander, @Jeffrey Drumm 
I came across your replies here and wanted to confirm I am having the same issue, but I am using the DTL editor and not so much code.  My base ADT is version 2.3.1 and I am transforming to 2.4.  In the DTL it seems that's there's no problem bridging the two messages, however, when the message is ultimately routed out of Ensemble, the message body says the DocType is 2.3.1 but the TypeVersion is 2.4, but also the DocTypeCategory is 2.3.1.  I suppose I would expect that after the transformation the message body would reflect the correct metadata but maybe I misundersand what it's supposed to represent in the context of the whole process?

In the DTL, I select "existing" as the Create action thinking that this will overwrite the data on the base object.

Would be interested in your understanding of all of this.