---
title: "List active HTTP sessions"
method: GET
path: "/api/v1/maintenance/_sessions"
tags: ["Maintenance"]
---

# List active HTTP sessions

`GET /api/v1/maintenance/_sessions`

## Request

- Base URL: `https://docs.anzworldline-solutions.com.au`
- URL: `https://docs.anzworldline-solutions.com.au/api/v1/maintenance/_sessions`
- Auth: none declared
- TypeScript: <https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/docs/api/v1/maintenance/_sessions/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns every active HTTP session tracked by SessionMonitor. Real session ids are never exposed; each entry instead carries a short HMAC-derived token that must be passed back to DELETE /v1/maintenance/_sessions/{token} to invalidate the session. The CSRF secret used to derive these tokens is stored in the caller's HTTP session and is valid for 15 minutes — re-call this endpoint to refresh.

## Response `200`

List of active sessions

- ResponseEntitySessionListView
  - `errors` ErrorEntity[]
    - `errorCode` string
    - `message` string
    - `fieldName` string
  - `entity` SessionView[]
    - `token` string, required: HMAC-obfuscated session token. Pass this value back to DELETE /v1/maintenance/_sessions/{token} to invalidate the session.
    - `userId` string, required: User id associated with the session (anonymous user id if no login).
    - `userEmail` string: Email of the user associated with the session. Null for sessions without an associated user account.
    - `userFullName` string: Full name of the user associated with the session. Null for sessions without an associated user account.
    - `address` string: Remote IP address recorded when the session was created. Null if the address was never captured (e.g. the session was created outside the servlet request pipeline that records it).
    - `sessionTime` string: Human-readable elapsed time since the session was created.
    - `isCurrent` boolean, required: True if this entry represents the caller's own session.
  - `messages` MessageEntity[]
    - `message` string
  - `i18nMessagesMap` object
  - `permissions` string[]
  - `pagination` Pagination
    - `currentPage` integer
    - `perPage` integer
    - `totalEntries` integer

## Other responses

- `401`: Unauthorized - authentication required
- `403`: Forbidden - CMS Administrator role required

## Changes

- **2026-10-30** `4fd8e917d458`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/changes/api/v1/maintenance/_sessions/get.md)

---

[API](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api.md) - [All operations](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anzworldline-solutions/apis/dotcms-rest-api/revisions/4fd8e917d458?raw)