---
title: "Get website session"
method: GET
path: "/api/website-sessions/{sid}"
tags: ["website_sessions"]
---

# Get website session

`GET /api/website-sessions/{sid}`

## Request

- Base URL: `https://beta.getsales.io/signals/v1`
- URL: `https://beta.getsales.io/signals/v1/api/website-sessions/{sid}`
- Auth: HTTP bearer and API key in header `Team-SID`

One session with its page list (path, title, engaged time), its forms and events, and with include the visitor, the person or the company it was bound to. Private context: never repeated to the lead.

Contract:
- MCP tool `get_website_session`, registry package `mcp.signals/website_sessions`, mount `signals.visits`.
- Operation `get`, response envelope `get`.
- Flags: read only.

## Path parameters

- `sid` string, required: The sg_ws_* sid of the row to read.

## Query parameters

- `include[]` string[]: Relations to attach to the row; omit for the bare row.

## Response `200`

`get` success envelope.

- GetWebsiteSessionResponse
  - `success` true, required
  - `operation` 'get', required
  - `item` object, required
    - `sid` string, required: Website session sid (sg_ws_...).
    - `team_sid` string, required: Owning team (ts_tm_..., external: gs.service.id).
    - `site_sid` string, required: The registered site (sg_si_...).
    - `visitor_sid` string, required: The browser behind the visit (sg_wv_...); a person may own several.
    - `person_sid` string, nullable, required: The person a rung named (cr_pp_..., playtables); null while nobody did. A person always takes a session over from a company.
    - `company_sid` string, nullable, required: The company a company code in our link or the network named when no person did (cr_co_..., playtables); cleared when a person takes the session over.
    - `attribution` 'code' | 'identified' | 'fingerprint' | 'manual' | 'company_code' | 'company_network' | 'none', required: Which rung named the owner: code (the person code in our link), identified (an identify or a form), fingerprint (the device), manual (a bind by hand), company_code (the company code in our link: the company, never a person; every code on a site set to companies), company_network (the network, a company); none while nothing did.
    - `fingerprint_sid` string, nullable, required: The device the fingerprint base saw the session from (sg_fp_...); null when none was stored.
    - `started_at` string, required: ISO 8601 UTC, the receipt time of the first hit. The feed's order, newest first.
    - `last_seen_at` string, required: ISO 8601 UTC, the receipt time of the newest hit; the row grows until the close.
    - `closed_at` string, nullable, required: ISO 8601 UTC, set by the sweep 30 minutes after last_seen_at; null = the visitor may still be on the site.
    - `pageviews_count` integer, required: Every page view, beyond the cap of pages too.
    - `engaged_seconds` integer, required: The sum over page views of the largest engaged time each reported.
    - `entry_path` string, required: The path of the first page view, with its query.
    - `exit_path` string, required: The path of the last page view.
    - `pages` object[], required: The first 50 page views, in order, each with its engaged time.
      - `page_id` string, required: The page view's id from the wire (12 characters).
      - `path` string, required: The page's path with its query, the code in our link removed by the script.
      - `title` string, nullable, required: The document title; null when none.
      - `engaged_seconds` integer, required: The largest engaged time a ping of this page view reported, in whole seconds.
      - `first_seen_at` string, required: ISO 8601 UTC, the receipt time of the pageview hit.
      - `scroll_pct` integer, nullable, required: The deepest scroll a ping of this page view reported, 0 to 100; null until one did (and on visits folded before 2026-10-07).
    - `events` object[], required: The first 50 custom events and forms, in order; every event the site sent, registered or not.
      - `kind` 'event' | 'form', required: event: a custom event the site sent; form: a form it reported (a marked form's submit, or a form a server-side identify named).
      - `name` string, required: The event's name or the form's name as the site sent it. A form's email never rides here.
      - `at` string, required: ISO 8601 UTC, the receipt time of the hit.
      - `page_id` string, required: The page view the hit belonged to.
    - `key_pages` string[], required: The keys (slugs) of the site's key pages reached, in the order first reached: what the key_page filter matches and the signal visited_key_page reads.
    - `referrer_type` 'direct' | 'internal' | 'search' | 'social' | 'email' | 'ads' | 'referral' | 'ai_assistant' | 'unknown', required: Where the visit came from, decided on the first page view: direct, internal (another page of the site), search, social, email, ads (a click id or a paid utm_medium), referral, ai_assistant (ChatGPT, Perplexity, Claude and the like), unknown.
    - `referrer_host` string, nullable, required: The referrer's host, lowercased, no www.; null when absent or unreadable.
    - `utm_source` string, nullable, required
    - `utm_medium` string, nullable, required
    - `utm_campaign` string, nullable, required
    - `utm_content` string, nullable, required
    - `utm_term` string, nullable, required
    - `landing_code` string, nullable, required: The first code a hit of the session carried (the person code or the company code in the link we sent); null when none.
    - `browser` string, nullable, required: The parser's name (Chrome, Safari, Firefox...); null when unknown.
    - `browser_version` string, nullable, required
    - `os` string, nullable, required: Windows, macOS, iOS, Android, Linux...; null when unknown.
    - `os_version` string, nullable, required
    - `device` 'desktop' | 'mobile' | 'tablet' | 'unknown', required: desktop | mobile | tablet | unknown.
    - `screen` string, nullable, required: {width}x{height} of the screen; null when the first page view did not report it.
    - `language` string, nullable, required: The browser's first language; null when not reported.
    - `timezone` string, nullable, required: The browser's IANA zone; null when not reported.
    - `geo_country` string, nullable, required: ISO 3166-1 alpha-2 from the edge's location header; null when the edge gave none.
    - `geo_region` string, nullable, required
    - `geo_city` string, nullable, required
    - `ip` string, required: The client address of the first hit (IPv4 or IPv6); its network part only once the network answer is stored on a site with anonymize_ip.
    - `network_status` 'pending' | 'resolved' | 'failed' | 'private', required: pending until the data service answered for the address; resolved with the network columns filled; failed (no answer after the asks); private (an address nobody is asked about).
    - `network_type` string, nullable, required: The data service's classification of the block: business, isp, mobile, hosting, education, government or unknown; null until resolved.
    - `network_name` string, nullable, required: The organization the block is registered to, else the registry's name of the block ("Deutsche Telekom", "Hetzner"); null until resolved.
    - `network_domain` string, nullable, required: The company domain the data service derived for a business network; null when none.
    - `asn` integer, nullable, required: The origin AS; null until resolved.
    - `as_name` string, nullable, required: The AS holder; null until resolved.
    - `is_internal` boolean, required: A hit came from one of the site's ignored_ips, or an identified email of the team's own domains: the team's own traffic, never a fact, never a signal.
    - `created_at` string, required: ISO 8601 UTC.
    - `updated_at` string, required: ISO 8601 UTC.
  - `included` object, required
    - `visitor` object: The browser behind the visit, the WebsiteVisitorDomain verbatim (bound person, identified email, sessions_count, the latest attributes; // see ./website_visitors.md).
      - `sid` string, required
    - `person` object: The person a rung named: { sid } today (cr_pp_...), the compact card is owed. Absent while person_sid is null.
      - `sid` string, required
    - `company` object: The company a company code or the network named when nobody else did: { sid } today (cr_co_...). Absent while company_sid is null.
      - `sid` string, required
  - `includes` string[], required
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-signals.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-signals/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-signals/revisions/310ca5d2219d?raw)