Skip to content
Artist Alley

List a user's active sessions (admin)

GET
/admin/users/{ref}/sessions

Admin view of a specific user’s sessions for the per-user admin detail page. Same row shape as the self-service endpoint; current is omitted (admins are viewing someone else’s sessions, not their own).

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
ref
required
integer format: int64

Responses

Section titled “ Responses ”

200

Section titled “200 ”

The user’s active sessions.

object
items
required
Array<object>

One active session. The user-agent is best-effort observability captured at login and can be null behind a proxy that strips it. current is true only on the self-service endpoint for the row that’s authenticating the request — the UI uses it to hide its own revoke button.

object
id
required
string format: uuid
created_at
required
string format: date-time
last_used_at
required
string format: date-time
expires_at
string format: date-time
nullable
ip

Client IP recorded at login — PERSONAL DATA, and returned ONLY on the admin view (GET /admin/users/{ref}/sessions, behind users.read), where locating a suspicious session is the point.

Never returned by GET /account/sessions (#567). That endpoint is self-scoped, and on a shared-account install “self” is every visitor — so the raw address is omitted unconditionally rather than gated, per the data- minimisation posture of ADR 0024.

Omitted from the JSON entirely, not blanked — the same convention AuditRow.ip uses (#425) — so an absent value always means “not returned to you” and never “no IP recorded”.

string
nullable
user_agent
string
nullable
current

True only on /account/sessions for the session that authenticated the request. Omitted on the admin equivalent.

boolean

401

Section titled “401 ”

Authentication required, missing, or invalid

object
error
required

Human-readable error summary

string
Example
the request could not be completed
Example
{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Section titled “403 ”

Authenticated but missing required capabilities

object
error
required

Human-readable error summary

string
Example
the request could not be completed

404

Section titled “404 ”

Resource not found

object
error
required

Human-readable error summary

string
Example
the request could not be completed