---
title: "Validate a session"
method: GET
path: "/sessions/validate"
tags: ["Session Management"]
---

# Validate a session

`GET /sessions/validate`

Validate a session using a cookie header or an authorization header.
This is a passive check that does not update the session's internal last activity timestamp.

## Response `200`

Session validation response

- object
  - `is_valid` boolean — Indicates whether the session is valid or not
  - `expiration_time` string, date-time — Date-time indicating the expiration of the session. Deprecated, please use `claims.expiration` instead.
  - `user_id` string, uuid4 — The ID of the user the session is associated with. Deprecated, please use `claims.subject` instead.
  - `claims` JWTClaims — The claims extracted from a JWT.
    - `subject` string, uuid4, required
    - `issued_at` string, date-time — The timestamp indicating when the token was issued.
    - `expiration` string, date-time, required — The timestamp indicating when the token will expire.
    - `audience` string[] — The intended audience of the token.
    - `issuer` string — The entity that issued the token.
    - `email` object — Data about the email address associated with the token's subject, if available.
      - `address` string, email — The actual email address.
      - `is_primary` boolean — Indicates whether the email address is the primary address.
      - `is_verified` boolean — Indicates whether the email address is verified.
    - `session_id` string, uuid4, required
    - `amr` string[] — Authentication Method References, JSON array of strings that are identifiers for authentication methods used in the authentication.
  - `idle_expires_at` string, date-time — Timestamp (in UTC) indicating when the session will expire due to inactivity, assuming no further activity occurs before this time. Only present when idle timeout is configured. The value is capped to the JWT expiration time.

## Other responses

- `400` — Bad Request
- `500` — Internal server error

---

[API](https://skmtc.dev/hanko/apis/hanko-admin-api.md) · [All operations](https://skmtc.dev/hanko/apis/hanko-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hanko/hanko-admin-api/revisions/d22a127b0978/schema)