---
title: "List active HTTP sessions"
method: GET
path: "/api/v1/maintenance/_sessions"
tags: ["Maintenance"]
---

# List active HTTP sessions

`GET /api/v1/maintenance/_sessions`

Returns every active HTTP session tracked by SessionMonitor. Real session ids are never exposed; each entry instead carries a short HMAC-derived token that must be passed back to DELETE /v1/maintenance/_sessions/{token} to invalidate the session. The CSRF secret used to derive these tokens is stored in the caller's HTTP session and is valid for 15 minutes — re-call this endpoint to refresh.

## Response `200`

List of active sessions

- ResponseEntitySessionListView
  - `errors` ErrorEntity[]
    - `errorCode` string
    - `message` string
    - `fieldName` string
  - `entity` SessionView[]
    - `token` string, required — HMAC-obfuscated session token. Pass this value back to DELETE /v1/maintenance/_sessions/{token} to invalidate the session.
    - `userId` string, required — User id associated with the session (anonymous user id if no login).
    - `userEmail` string — Email of the user associated with the session. Null for sessions without an associated user account.
    - `userFullName` string — Full name of the user associated with the session. Null for sessions without an associated user account.
    - `address` string — Remote IP address recorded when the session was created. Null if the address was never captured (e.g. the session was created outside the servlet request pipeline that records it).
    - `sessionTime` string — Human-readable elapsed time since the session was created.
    - `isCurrent` boolean, required — True if this entry represents the caller's own session.
  - `messages` MessageEntity[]
    - `message` string
  - `i18nMessagesMap` object
  - `permissions` string[]
  - `pagination` Pagination
    - `currentPage` integer
    - `perPage` integer
    - `totalEntries` integer

## Other responses

- `401` — Unauthorized - authentication required
- `403` — Forbidden - CMS Administrator role required

---

[API](https://skmtc.dev/jostens/apis/dotcms-rest-api.md) · [All operations](https://skmtc.dev/jostens/apis/dotcms-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jostens/dotcms-rest-api/revisions/a088fe9f515c/schema)