API Reference
Getting Started
Core Concepts
Backend API — Guides
Frontend API — Guides
OAuth & OpenID Connect — Guides
Enterprise: SSO & SCIM — Guides
Webhooks — Guides
SDKs
Backend API (BAPI)
Frontend API (FAPI)
Dashboard API
Public API
SCIM
OIDC
Platform

Sessions

AdminUpdated Sep 11, 2026

Sessions

Backend API — secret key (Authorization: Bearer sk_…).

4 routes. Each row is one endpoint with its explanation, required scope, and whether it honours the Idempotency-Key header.

Method & path

Scope

Idem

Explanation

POST /v1/sessions

sessions:write

Mint a session for a user in one call — returns jwt + refresh_token. For agents/testing; bypasses the sign-in gate. Optional actor.sub for an impersonation session.

GET /v1/sessions

sessions:read

List a user's active sessions. Requires a user_id query parameter.

GET /v1/sessions/:id

sessions:read

Fetch a single session. Another instance session id is 404, never 403.

POST /v1/sessions/:id/revoke

sessions:write

Revoke one session, signing that device out.

Was this page helpful?