List my active sessions (multi-device)

GET

/account/sessions

• Local development behind nginx (port 8088 by default)

Surfaces the caller’s own active sessions for the /account/sessions self-service page. The row that’s authenticating this request carries current: true so the UI can hide its own revoke button.

Never returns ip — see SessionRow.ip (#567). Devices are identified by user-agent.

In demo mode (AA_DEMO_MODE=1) every visitor shares one account, so this returns ONLY the session authenticating the request rather than every visitor’s.

Authorizations

• cookieAuth
• bearerAuth

Responses

200

List of the caller’s active sessions.

object

items

required

Array<object>

One active session. The user-agent is best-effort observability captured at login and can be null behind a proxy that strips it. current is true only on the self-service endpoint for the row that’s authenticating the request — the UI uses it to hide its own revoke button.

object

id

required

string format: uuid

created_at

required

string format: date-time

last_used_at

required

string format: date-time

expires_at

string format: date-time

nullable

ip

Client IP recorded at login — PERSONAL DATA, and returned ONLY on the admin view (GET /admin/users/{ref}/sessions, behind users.read), where locating a suspicious session is the point.

Never returned by GET /account/sessions (#567). That endpoint is self-scoped, and on a shared-account install “self” is every visitor — so the raw address is omitted unconditionally rather than gated, per the data- minimisation posture of ADR 0024.

Omitted from the JSON entirely, not blanked — the same convention AuditRow.ip uses (#425) — so an absent value always means “not returned to you” and never “no IP recorded”.

string

nullable

user_agent

string

nullable

current

True only on /account/sessions for the session that authenticated the request. Omitted on the admin equivalent.

boolean

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}