List a user's active sessions (admin)

GET

/admin/users/{ref}/sessions

• Local development behind nginx (port 8088 by default)

Admin view of a specific user’s sessions for the per-user admin detail page. Same row shape as the self-service endpoint; current is omitted (admins are viewing someone else’s sessions, not their own).

Gated on users.read. The session ip is omitted for callers without users.pii.read on top of it (#573), exactly as /admin/audit withholds actor IPs from callers lacking system.audit.pii.read (#425) — one data class, one bar. The rest of the row is unaffected, so a support role can still label and revoke devices without holding the addresses.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

ref

required

integer format: int64

Responses

200

The user’s active sessions.

object

items

required

Array<object>

One active session. The user-agent is best-effort observability captured at login and can be null behind a proxy that strips it. current is true only on the self-service endpoint for the row that’s authenticating the request — the UI uses it to hide its own revoke button.

object

id

required

string format: uuid

created_at

required

string format: date-time

last_used_at

required

string format: date-time

expires_at

string format: date-time

nullable

ip

Client IP recorded at login — PERSONAL DATA, and returned ONLY on the admin view (GET /admin/users/{ref}/sessions), where locating a suspicious session is the point, and there only to callers holding users.pii.read on top of the users.read that admits them to the list at all (#573).

That is the same shape audit uses for actor IPs — system.audit.pii.read on top of system.audit.read (#425). Raw IPs are one data class with one bar, gated <area>.pii.read additive to <area>.read (ADR 0072).

Never returned by GET /account/sessions (#567). That endpoint is self-scoped, and on a shared-account install “self” is every visitor — so the raw address is omitted unconditionally rather than gated, per the data- minimisation posture of ADR 0024.

Omitted from the JSON entirely, not blanked — the same convention AuditRow.ip uses (#425) — so an absent value always means “not returned to you” and never “no IP recorded”.

string

nullable

user_agent

string

nullable

current

True only on /account/sessions for the session that authenticated the request. Omitted on the admin equivalent.

boolean

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed