Query sessions
Returns the sessions of a project, paginated with a cursor. Sessions of every lifecycle state are returned; each carries its `state`. Requires `session.read` permission.
Returns the sessions of a project, paginated with a cursor.
Sessions of every lifecycle state are returned; each carries its state.
Requires session.read permission.
Authorization
oauth2 session.readIn: header
Scope: session.read
Query Parameters
The unique identifier of the project
Request Body
application/json
Request to query the sessions of a project.
TypeScript Definitions
Use the request body type in TypeScript.
Request to query the sessions of a project.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/sessions/query?project_id=proj_01hexample" \ -H "Content-Type: application/json" \ -d '{}'{ "sessions": [ { "session_id": "sess_01J0Z9KX7Y0Q2Y7JX5M9K2YF3C", "project_id": "proj_01hexample", "state": "active", "user_id": "user_id_12345", "name": "Ada Lovelace", "email": "ada@example.com", "factors": [ { "method": "password", "verified_at": "2026-04-28T15:32:00Z", "payload": { "user_id": "user_id_12345" } } ], "assurance_levels": [ "urn:nist:aal:1", "urn:nist:aal:2" ], "metadata": {}, "user_agent": { "fingerprint": "fp_abc123", "ip": "203.0.113.42" }, "created_at": "2026-04-29T10:00:00Z", "expires_at": "2026-04-30T10:00:00Z" } ], "next_page_token": "v1.dGhpcyBpcyBvcGFxdWU.SflKxwRJSMeKKF2QT4fw"}{ "code": "string", "message": "string", "details": {}}{ "code": "string", "message": "string", "details": {}}{ "code": "string", "message": "string", "details": {}}{ "code": "auth.unauthorized", "message": "The request lacks valid authentication credentials."}Get session state GET
Returns the current state of a session including its factors and all currently satisfied assurance levels. `assurance_levels[]` may shrink over time as factor freshness windows expire, without the session itself expiring. Use step-up authentication (a new `auth_attempt` against the same `session_id`) to restore a dropped assurance level.
Revoke my session DELETE
Logs out by permanently deleting the session. The `__nextgen_session` cookie issued at creation (or superseded by a handoff exchange) is required. Idempotent: if the session is already gone this still returns 204. Any tokens derived from the session are invalidated, and the cookie itself is cleared in the response.