---
title: "Validate a session"
method: POST
path: "/sessions/validate"
tags: ["Session Management"]
---

# Validate a session

`POST /sessions/validate`

Validate a session using a session token in a request body.
This endpoint updates the session's internal last activity timestamp. This extends the idle timeout window
if configured).

## Request body

- object
  - `session_token` string, JWT, required — The session token (JWT) to validate

## Response `200`

Session validation response

- object
  - `is_valid` boolean — Indicates whether the session is valid or not
  - `expiration_time` string, date-time — Date-time indicating the expiration of the session. Deprecated, please use `claims.expiration` instead.
  - `user_id` string, uuid4 — The ID of the user the session is associated with. Deprecated, please use `claims.subject` instead.
  - `claims` JWTClaims — The claims extracted from a JWT.
    - `subject` string, uuid4, required
    - `issued_at` string, date-time — The timestamp indicating when the token was issued.
    - `expiration` string, date-time, required — The timestamp indicating when the token will expire.
    - `audience` string[] — The intended audience of the token.
    - `issuer` string — The entity that issued the token.
    - `email` object — Data about the email address associated with the token's subject, if available.
      - `address` string, email — The actual email address.
      - `is_primary` boolean — Indicates whether the email address is the primary address.
      - `is_verified` boolean — Indicates whether the email address is verified.
    - `session_id` string, uuid4, required
    - `amr` string[] — Authentication Method References, JSON array of strings that are identifiers for authentication methods used in the authentication.
  - `idle_expires_at` string, date-time — Timestamp (in UTC) indicating when the session will expire due to inactivity, assuming no further activity occurs before this time. Only present when idle timeout is configured. The value is capped to the JWT expiration time.

## Other responses

- `400` — Bad Request
- `500` — Internal server error

---

[API](https://skmtc.dev/hanko/apis/hanko-admin-api.md) · [All operations](https://skmtc.dev/hanko/apis/hanko-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hanko/hanko-admin-api/revisions/d22a127b0978/schema)