---
title: "List my verification sessions"
method: GET
path: "/verification/sessions"
tags: ["verification"]
---

# List my verification sessions

`GET /verification/sessions`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/verification/sessions`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

The caller's own verification sessions (one row per provider and type). Self-scoped: a filter narrows this set and can never reach another account's rows. With NO query string the response is the legacy `{success, data:[...], count}` shape, every row, provider ASC — unchanged for existing clients. With `limit` or `offset` the response is the ADR 0003 envelope `{success, data:{items, total, filtered, limit, offset}}`: `total` is the caller's row count before filters, `filtered` after, `items` one page; `limit=0` returns the counts alone. Filters or a sort WITHOUT `limit`/`offset` return the legacy shape over the filtered, sorted rows. `status`/`type`/`provider` are comma-separated ORs; an unrecognised member matches nothing (never a 400). `q` is a case-insensitive substring match over session_id, provider, status and last_error. `from`/`to` bound "last moved" = verified_at, else updated_at: `YYYY-MM-DD` is an inclusive whole UTC day, RFC3339 an exact instant (`to` exclusive); malformed is a 400. `since`/`until` and `created_after`/`created_before` are accepted as aliases. Every sort tiebreaks on id in the same direction, so pages never repeat or skip a row. An unknown query KEY is `400 unknown_param`.

## Query parameters

- `status` string
- `type` string
- `provider` string
- `q` string
- `from` string
- `to` string
- `sort` 'created' | 'updated' | 'status' | 'type' | 'attempts'
- `sort_dir` 'asc' | 'desc'
- `limit` integer
- `offset` integer
- `group_id` string, uuid
- `exclude_group_id` string, uuid

## Response `200`

paged envelope (legacy {success,data:[],count} when limit/offset absent)

- InternalDeliveryHttpHandlerSessionsPageResponse
  - `data` InternalDeliveryHttpHandlerSessionsPage
    - `filtered` integer
    - `items` EnforcerV3InternalDomainVerificationSession[]
      - `account_id` string
      - `attempt_count` integer
      - `blocked_reason` string
      - `can_retry` boolean: Computed on read by Decorate, never stored. The server owns this policy: a client that re-derives it from Status will get `expired` wrong (it is retryable) and will conflate `verified` with being blocked.
      - `challenge_data` EnforcerV3InternalDomainVerificationJSONBMap
      - `created_at` string
      - `expires_at` string
      - `external_customer_id` string
      - `id` string
      - `idempotency_key` string
      - `last_error` string
      - `last_refreshed_at` string
      - `last_used_at` string
      - `metadata` EnforcerV3InternalDomainVerificationJSONBMap
      - `provider` string
      - `provider_id` string
      - `rejection_scope` string: RejectionScope names WHICH terminal state this is — ScopeVerification (this inquiry failed, re-sendable) or ScopeCustomer (the provider rejected the customer outright, nothing on our side lifts it). NULL/"" means the provider never told us, which is every row written before migration 000093.
      - `remedy` string
      - `response_data` EnforcerV3InternalDomainVerificationJSONBMap
      - `session_id` string
      - `session_type` string
      - `status` string
      - `status_history` EnforcerV3InternalDomainVerificationStatusTransition[]
        - `from` string
        - `reason` string
        - `timestamp` integer: unix seconds
        - `to` string
      - `tenant_id` string
      - `type` string
      - `updated_at` string
      - `verification_guid` string
      - `verified_at` string
    - `limit` integer
    - `offset` integer
    - `total` integer
  - `success` boolean

## Other responses

- `400`: unknown_param | invalid_limit | invalid_offset | invalid_from | invalid_to | invalid_window | invalid_group_id | invalid_exclude_group_id
- `401`: Unauthorized

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)