---
title: "Get Sessions"
method: GET
path: "/v3/sessions"
tags: ["Sessions"]
---

# Get Sessions

`GET /v3/sessions`

Returns a paginated list of network sessions matching the query criteria.
Sessions represent individual network connections captured by GreyNoise sensors.

## Query parameters

- `scope` 'workspace' | 'demo'
- `start_time` string, date-time, required
- `end_time` string, date-time, required
- `query` string
- `page` integer
- `page_size` integer
- `sort_by` string
- `sort_desc` 'true' | 'false'

## Response `200`

OK - request successful.

- SessionsResponse
  - `sessions` Session[] — Array of session objects matching the query.
    - `_id` string — Unique session identifier.
    - `firstPacket` string, date-time — Timestamp of the first packet in the session.
    - `lastPacket` string, date-time — Timestamp of the last packet in the session.
    - `source.ip` string — Source IP address.
    - `source.port` integer — Source port number.
    - `destination.ip` string — Destination IP address.
    - `destination.port` integer — Destination port number.
    - `source.bytes` integer — Total bytes sent from source.
    - `source.packets` integer — Total packets sent from source.
    - `destination.bytes` integer — Total bytes sent from destination.
    - `destination.packets` integer — Total packets sent from destination.
    - `classification` string — GreyNoise classification of the source IP.
  - `total` integer — Total number of sessions matching the query.
  - `pagination` SessionPagination
    - `page` integer — Current page number.
    - `page_size` integer — Number of results per page.
    - `sort_by` string — Field used for sorting.
    - `sort_desc` boolean — Whether results are sorted in descending order.
  - `request_metadata` SessionRequestMetadata
    - `start_time` string — Start time of the query range.
    - `end_time` string — End time of the query range.
    - `query` string — The Lucene query string used.

## Other responses

- `400` — Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again.
- `401` — Unauthorized. Please check your API key.
- `403` — Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.
- `429` — Too many requests. You've hit the rate-limit.
- `500` — Unexpected error

---

[API](https://skmtc.dev/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.dev/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/revisions/30942574656d/schema)