---
title: "Search sessions"
method: POST
path: "/api/sessions/search"
tags: ["sessions"]
---

# Search sessions

`POST /api/sessions/search`

## Request

- Base URL: `https://beta.getsales.io/id/v1`
- URL: `https://beta.getsales.io/id/v1/api/sessions/search`
- Auth: HTTP bearer and API key in header `Team-SID`

The signed-in sessions: the caller's own active ones by default (Active sessions), kind.eq oauth for the connected apps and agents, status for revoked or expired history. is_current marks the row behind the calling token, so "sign out everywhere else" skips it. page_size 0 returns the counts only.

Contract:
- MCP tool `search_sessions`, registry package `mcp.id/sessions`, mount `id.identity`.
- Operation `search`, response envelope `search`.
- Flags: read only.

## Request body

- SearchSessionsRequest: Request body of `search_sessions`.
  - `filter` object: Field filters, ANDed: {field: {eq | ne | in | nin | gte | lte | gt | lt | is_null}}; q inside it is free text. Omit for every row.
    - `sid` object: Session sid(s).
      - `eq` string
      - `in` string[]
    - `user_sid` object: Own sessions by default; other users need the sessions view permission.
      - `eq` string
      - `in` string[]
    - `team_sid` object: The workspace(s) signed into.
      - `eq` string
      - `in` string[]
    - `status` object: Default scope is { eq: active }; pass it for revoked or expired history.
      - `eq` 'active' | 'revoked' | 'expired'
      - `ne` 'active' | 'revoked' | 'expired'
      - `in` string[]
      - `nin` string[]
    - `kind` object: kind.eq oauth = the connected apps and agents.
      - `eq` 'login' | 'oauth'
      - `in` string[]
    - `oauth_client_sid` object: is_null true = login sessions only.
      - `eq` string
      - `in` string[]
      - `is_null` boolean
    - `last_active_at` object: ISO 8601 bounds.
      - `gte` string
      - `lte` string
      - `gt` string
      - `lt` string
    - `expires_at` object: ISO 8601 bounds.
      - `gte` string
      - `lte` string
      - `gt` string
      - `lt` string
    - `created_at` object: ISO 8601 bounds.
      - `gte` string
      - `lte` string
      - `gt` string
      - `lt` string
  - `sort` object: One column and its direction; omit for the default order.
    - `field` 'last_active_at' | 'created_at' | 'expires_at', required: The column to order by.
    - `direction` 'asc' | 'desc': asc or desc; default desc.
  - `page_size` integer: 0..500, default 50; 0 = counts only, 1 = the first row.
  - `cursor` string, nullable: pagination.next_cursor of the previous page.

## Response `200`

`search` success envelope.

- SearchSessionsResponse
  - `success` true, required
  - `operation` 'search', required
  - `items` object[], required
    - `item` object, required
      - `sid` string, required: Session sid (id_se_...).
      - `team_sid` string, required: The workspace the session is signed into (ts_tm_...).
      - `user_sid` string, required: The account (us_mb_...).
      - `status` 'active' | 'revoked' | 'expired', required: active = the token is accepted; revoked | expired = it is not.
      - `kind` 'login' | 'oauth', required: login = a browser or app sign-in; oauth = an installation token of a connected app or agent.
      - `oauth_client_sid` string, nullable, required: The OAuth client (id_oc_...) behind a kind oauth session; null on a login.
      - `oauth_authorization_sid` string, nullable, required: The grant (id_oa_...) the installation token was minted from; null on a login.
      - `device` string, nullable, required: The browser or client as reported at sign-in.
      - `ip_hash` string, nullable, required: A hash of the sign-in address, never the address.
      - `last_active_at` string, required: ISO 8601 UTC; bumped lazily, about every 30 s, by requests to this service.
      - `expires_at` string, required: ISO 8601 UTC; the refresh credential's end (14 days by default; about 15 minutes for an agent token).
      - `created_at` string, required: ISO 8601 UTC.
      - `updated_at` string, required: ISO 8601 UTC.
      - `is_current` boolean, required: true on the row behind the calling token.
    - `included` object, required
  - `pagination` object, required
    - `next_cursor` string, nullable, required
    - `has_more` boolean, required
    - `total_count` integer, nullable, required
  - `applied_filters` object, required
  - `includes` string[], required
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
  - `counts` object
    - `total_count` number, required: Sessions matching the filter across EVERY status (the default active scope applies to the page and pagination.total_count, never here).
    - `groups` object, required: status and kind: the count per value.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/revisions/95e48541fe85?raw)