IBKR's Web API makes use of two nested sessions.
- The first session layer grants "read-only" access to your account structure but does not permit use of any /iserver endpoints. At this stage, no trading or consumption of paid market data is possible, though you may still access portfolio data. This first layer is a prerequisite for the second.
- The second session layer is the "brokerage session". A brokerage session can be created only after you have obtained read-only access to the Web API. The brokerage session permits requests to all /iserver endpoints and effectively confers "write" access.