---
updatedAt: 2026-04-08T10:25:01.000Z
---

# Legacy authentication method: JSESSIONID user sessions

[block:callout]
{
  "type": "danger",
  "body": "If your organization was created after April 30, 2019, OAuth will be the only option of authentication that is available to you. For any questions about migrating onto the OAuth process, contact your CSM or Support.",
  "title": "Feature is deprecated"
}
[/block]

Our Username/Password paradigm for authenticating against both our UI and our API will continue to be supported, but is considered to be a legacy feature. This approach allows your external systems to securely store a customer-defined integration user’s credentials within them to subsequently authenticate and gain access to the Campaign Automation.

**Note**: After completing the API actions, you must use a Logout request to close and invalidate the session. The methods used for authenticating against Engage with JSESSIONIDs are as follows.

## User Login

Login
Before calling any operation, you must obtain a Jsession ID using the Login operation as shown below.

**Operation <Login>**
**Elements**

* USERNAME - Campaign Automation user’s name
* PASSWORD - Campaign Automation user’s password
  **Example**
  <Envelope>
    <Body>
  <Login>
    <USERNAME></USERNAME>
    <PASSWORD>userpassword</PASSWORD>
  </Login>
    </Body>
  </Envelope>

**Response <Result>**
**Elements**

* SUCCESS - TRUE (Always set to TRUE for successful login)
* SESSIONID - System-generated session ID
* SESSION\_ENCODING - Encoding of the system-generated session ID. The format for SESSION\_ENCODING is as follows: ;jsessionid=SESSIONID where SESSIONID is the system-generated session ID returned.
* ORGANIZATION\_ID - Identifies your Campaign Automation Organization
  **Example**
  <Envelope>
    <Body>
      <RESULT>
   <SUCCESS>true</SUCCESS>
   <SESSIONID>dc302149861088513512481</SESSIONID>
   <SESSION_ENCODING>;jsessionid=dc302149861088513512481
   </SESSION_ENCODING>
      </RESULT>
    </Body>
  </Envelope>

## User Logout

Logout
After completing the API actions, you must use a Logout request to close and invalidate the session, as shown below.

This API call is important both from the perspective of better securing your customer data from hackers as well as allows our servers to perform optimally for your subsequent calls.

**Operation <Logout>**
**Elements** - None
**Example**

<Envelope>
  <Body>
    <Logout/>
  </Body>
</Envelope>

**Response <Result>**
**Elements**

* SUCCESS - TRUE (To successfully log off the system, always set to TRUE)
  **Example**
  <Envelope>
    <Body>
  <RESULT>
    <SUCCESS>TRUE</SUCCESS>
  </RESULT>
    </Body>
  </Envelope>