From ProventusNova DeveloperWiki

This endpoint requires a CSRF-safe session provider.