---
title: "Update Session"
method: PATCH
path: "/api/v1/sessions/{session_id}"
tags: ["sessions"]
---

# Update Session

`PATCH /api/v1/sessions/{session_id}`

## Request

- Base URL: `https://api.gnosari.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gnosari.com/api/v1/sessions/{session_id}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-AUTH-TOKEN`

Update session fields (excludes created_at and updated_at).

Supports three access levels based on session's agent/team:
- PUBLIC: No authentication required
- PASSWORD_PROTECTED: X-Access-Password header required
- PRIVATE: User authentication required

Supports team_identifier and agent_identifier strings to lookup team_id and agent_id.
If identifiers are provided and found, the corresponding IDs will be set.
If not found, team_id and agent_id will be set to NULL.

## Path parameters

- `session_id` string, required

## Headers

- `X-Access-Password` string, nullable

## Request body

- SessionUpdate: Schema for updating a session. NOTE: session_type is intentionally NOT included here. Session types are set at creation time and should not be modified via API. This prevents users from hiding sessions by changing them to INTERNAL.
  - `team_id` integer, nullable
  - `agent_id` integer, nullable
  - `team_identifier` string, nullable
  - `agent_identifier` string, nullable
  - `messages` SessionMessageCreate[], nullable
    - `message_data` string, required

## Response `200`

Successful Response

- Session
  - `session_id` string, required
  - `team_id` integer, nullable
  - `agent_id` integer, nullable
  - `team_identifier` string, nullable
  - `agent_identifier` string, nullable
  - `summary` string, nullable
  - `summary_metadata` object, nullable: Metadata from summary generation: key_topics, sentiment, action_items, primary_intent
  - `session_type` 'USER' | 'INTERNAL' | 'DEBUG': Session type for visibility control. Following SOLID principles: - Single Responsibility: Each type has one clear visibility pattern - Open/Closed: New types can be added without modifying existing code
  - `channel` 'JOINA_CHAT' | 'QR' | 'WIDGET' | 'INTERNAL' | 'API': Origin channel a session was created on — informational display metadata. Set once at creation on the client-known surface (``POST /sessions``) and surfaced on reads so the Collected Data inbox can render "via joina.chat" per record. Mirrors ``SessionType``'s varchar+StrEnum shape MINUS the index. INFORMATIONAL AND FORGEABLE BY DESIGN: it rides a public unauthenticated ``POST /sessions`` and is enum-validated (invalid → 422) but NEVER drives authorization or visibility — that stays ``session_type``. Do not "fix" this as a security hole.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `messages` SessionMessage[]
    - `message_data` string, required
    - `id` integer, required
    - `session_id` string, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `attachments` MessageAttachmentRef[]: Attachment references parsed from message_data content parts (Phase 7). Empty for text-only messages.
      - `asset_id` string, required
      - `kind` string, required: asset.kind vocabulary: image | document
      - `filename` string, nullable
  - `team` TeamInfo
    - `id` integer, required
    - `name` string, required
    - `identifier` string, nullable
    - `agents` AgentInfo[]
      - `id` integer, required
      - `name` string, required
      - `identifier` string, nullable
  - `agent` AgentInfo
    - `id` integer, required
    - `name` string, required
    - `identifier` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/gnosari/apis/gnosari-api.md) · [All operations](https://skmtc.dev/gnosari/apis/gnosari-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gnosari/apis/gnosari-api/revisions/f299cf53ae5f?raw)