1 files changed, 3 insertions, 2 deletions
diff --git a/api.md b/api.md
index a0a4488..1b78a41 100644
--- a/api.md
+++ b/api.md
@@ -21,8 +21,9 @@ Returns API version number.
 
 ## POST `/api/create_session`
 
-Request body contains JSON with keys `username`, `password` and `expire` (in
-seconds). The Response contains the session cookie as a string in JSON.
+Request body contains JSON with keys `username`, `password`, `expire` (in
+seconds) and `drop_permissions` (a list of permissions, that this session cannot
+use). The Response contains the session cookie as a string in JSON.
 
 ## GET* `/n/<id>`