---
title: "Sessions"
method: GET
path: "/auth/sessions"
tags: ["auth"]
---

# Sessions

`GET /auth/sessions`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/auth/sessions`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

The caller's own active and recent login sessions (device, IP, issued/last-seen times). Scoped to the caller only — there is no cross-account session listing here.

## Response `200`

OK

- InternalDeliveryHttpHandlerSessionListResponse
  - `count` integer
  - `data` EnforcerV3InternalUsecaseAuthSessionInfo[]
    - `client_ip` string
    - `created_at` string: CreatedAt is when the SESSION started, not when its current token was minted. Rotation used to advance this, so a session refreshed every 15 minutes always reported itself as 15 minutes old.
    - `current` boolean: Current marks the session this request is being made from — the one the caller must NOT revoke if they intend to stay signed in. Resolved from whichever id space the caller is in: the access token's sid claim for an enforcer session, the provider's sid for a Privy one. Still false for every session when the credential carries neither (API key, portal link).
    - `expires_at` string: ExpiresAt is nil for a provider session. Privy owns that session's lifetime and never tells us when it ends; reporting a guess on a security surface would be worse than reporting nothing.
    - `id` string
    - `kind` string: Kind names which id space this session lives in. "enforcer" is a refresh-token family; "privy" is a session the PROVIDER owns, which a client authenticating with a raw Privy bearer is the only kind it has. Before 000092 those were invisible here, so the primary client's session list was permanently empty — the endpoint existed and answered "none".
    - `last_used_at` string: LastUsedAt is the last refresh for an enforcer session, and the last time the token was PRESENTED for a provider one (advanced by a throttled write, so it lags by up to one interval). Nil only for an enforcer session that has never rotated.
    - `signed_in_at` string
    - `signed_in_with` string[]: SignedInWith and SignedInAt are how and when the person signed in to this session (000134): a refresh or a workspace switch moves neither, so "signed in with a passkey 3 days ago" stays true however often it renews. Absent for a session from before 000134 and for provider sessions.
    - `user_agent` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)