---
title: "Verify a current guest session"
method: POST
path: "/guest-access/sessions/verify"
tags: ["Guest access"]
---

# Verify a current guest session

`POST /guest-access/sessions/verify`

## Request

- Base URL: `https://api.aisle.wedding/v1`
- URL: `https://api.aisle.wedding/v1/guest-access/sessions/verify`
- Auth: HTTP bearer

Requires read scope and preview access. Checks the signed session, its wedding, expiry, current credential version, revocation and surviving members. Supply guest_id before reading or writing for a selected guest; a guest outside the grant is forbidden. Membership or expiry changes and rotation invalidate prior sessions. Returns current access without echoing the session token. This endpoint does not make the broad wedding API key guest-scoped; your server must enforce this result before each existing guest endpoint call.

## Request body

- GuestAccessSessionVerify
  - `session_token` string, required
  - `guest_id` string

## Response `200`

Verify a current guest session

- object
  - `data` GuestAccessSession, required
    - `access` GuestAccess, required
      - `id` string, required
      - `name` string, nullable, required
      - `guest_ids` GuestId[], required
      - `expires_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.
      - `revoked_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.
      - `created_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.
      - `updated_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.
    - `expires_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.

## Other responses

- `400`: The request itself could not be read, such as a body that is not a JSON object. A field we refuse is validation_failed instead.
- `401`: The API key is missing, malformed, or no longer valid.
- `402`: The operation requires an active Aisle membership for this wedding.
- `403`: The key is valid but not permitted to do this.
- `404`: No such resource inside the key's wedding.
- `409`: The request collided with the current state of the resource.
- `415`: A request body must be sent as application/json.
- `422`: The request was well-formed but a field was not acceptable. Every field at fault is named in error.details.
- `429`: Too many requests. Retry after the time given in Retry-After.
- `500`: Something went wrong on our side.

---

[API](https://skmtc.dev/aisle/apis/aisle-api.md) · [All operations](https://skmtc.dev/aisle/apis/aisle-api/llms.txt) · [OpenAPI document](https://skmtc.dev/aisle/apis/aisle-api/revisions/689a2f2420cc?raw)