Even the session cookie must be obtained with username/password, so there's no way around that.  What we and many others do: create a dedicated user with minimal and read-only access privileges to the required API sections.  hth -- Peter
Hi,  From reading  [URL]  page 17, it seems  "Session cookies are configured to expire automatically in 15 minutes after a period of inactivity or in 4 hours after an absolute period of time."  I was looking to create a job running via REST to gather stats, but the session cookie is too short lived and I do not want to have cleartext username/password. Another vendor uses an API key which is challenge/responded to.  Any ideas on what options are ?
REST API passwordless authentication