---
title: "Verify session token"
method: POST
path: "/v1/sessions/verify"
tags: ["sessions"]
---

# Verify session token

`POST /v1/sessions/verify`

Verify a session identity token issued for a captain session. The caller must have access to the project that owns the session so the endpoint cannot be used for cross-tenant enumeration. Failure responses are intentionally opaque: only `expired` is distinguished from `invalid`, and callers should always confirm the returned `projectId` matches the project they expect before trusting the result.

## Request body

- VerifySessionBody
  - `token` string, required

## Response `200`

Success

- union
  - object
    - `valid` true, required
    - `threadId` string, required
    - `projectId` string, required
    - `orgId` string, nullable, required
    - `userId` string, required
    - `instanceId` string, required
    - `issuedAt` string, required
    - `expiresAt` string, required
  - object
    - `valid` false, required
    - `reason` 'invalid' | 'expired', required

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `422` — Validation error
- `500` — Internal error

---

[API](https://skmtc.dev/capy/apis/capy-api.md) · [All operations](https://skmtc.dev/capy/apis/capy-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/capy/capy-api/revisions/c9ea28cb32b6/schema)