---
title: "List all sessions"
method: GET
path: "/api/v1/sessions"
tags: ["Sessions"]
---

# List all sessions

`GET /api/v1/sessions`

## Request

- Base URL: `https://api.korala.ai`
- URL: `https://api.korala.ai/api/v1/sessions`
- Auth: one of:
  - API key in header `X-API-Key`
  - `bearer` (a scheme the document does not define)

## Query parameters

- `originContextId` string
- `subjectId` string
- `externalUserId` string
- `status` 'created' | 'in_progress' | 'pending_review' | 'completed' | 'expired' | 'failed'
- `resolution` 'approved' | 'rejected'
- `page` number
- `limit` number

## Headers

- `X-Korala-Mode` 'live' | 'test'

## Response `200`

- PaginatedSessionsDto
  - `data` SessionDto[], required
    - `originContextId` string, nullable: Registered originating risk context; null when none was linked. This association does not determine evidence applicability.
    - `subjectId` string, nullable: Explicitly linked Korala risk subject ID; null for unlinked sessions.
    - `sandbox` boolean, required: Persisted execution mode: true for test data
    - `id` string, required
    - `organizationId` string, required
    - `externalUserId` string, required
    - `subjectKind` 'individual' | 'business', required
    - `finalManualReviewRequired` boolean, required
    - `accessToken` string, required: Access token for end-user access
    - `status` 'created' | 'in_progress' | 'pending_review' | 'completed' | 'expired' | 'failed', required
    - `resolution` 'approved' | 'rejected'
    - `resolutionReason` string, nullable
    - `resolvedAt` string, date-time, nullable
    - `resolvedBy` string, nullable
    - `riskScore` number, nullable
    - `riskLevel` 'low' | 'medium' | 'high'
    - `riskSummary` RiskAssessmentDto
      - `kind` 'sybil' | 'velocity' | 'duplicate_document' | 'device_cluster' | 'location_cluster' | 'network_mismatch', required
      - `score` number, required
      - `level` 'low' | 'medium' | 'high', required
      - `reasons` string[], required
      - `findingCount` number, required
      - `findings` RiskFindingDto[], required
        - `code` string, required
        - `severity` 'low' | 'medium' | 'high', required
        - `entityType` string, required
        - `observedAt` string, required: ISO 8601 timestamp
        - `entityId` string, nullable
        - `metadata` object, required
      - `metrics` object, required
      - `manualReviewRecommended` boolean, required
    - `eventVersion` number, required: Grows with each change announced by a session webhook; compare it with the webhook's `data.version`. The higher number is the newer state; numbers may skip.
    - `decision` SessionDecisionDto
      - `outcome` 'approved' | 'rejected' | 'review' | 'resubmit', required
      - `decidedBy` 'auto' | 'reviewer' | 'partner', required: auto: Korala decided; reviewer: someone in the dashboard; partner: your integration through the API
      - `decidedAt` string, required
      - `rulesVersion` string, required: The rules that made the decision. v2 adds the identity switch between attempts and the unnumbered-attempt rule; records made under v1 keep it.
      - `reasonCodesVersion` string, required
      - `codes` string[], required: Why: the decline codes of a rejection, or the codes holding a session in review
      - `decidingCheckIds` string[], required
      - `findings` SessionDecisionFindingDto[], required
        - `code` string, required: Korala reason code, family.name (for example screening.sanctions_match)
        - `effect` 'decline' | 'review' | 'resubmit', required
        - `checkId` string, nullable, required: The check that produced this finding; null for a session-level finding (missing evidence, duplicate identity, validation, a required manual decision).
      - `attempts` SessionDecisionAttemptDto[], required
        - `sessionWorkflowId` string, required
        - `workflowRunId` string, required
        - `attempt` number, nullable, required: The run's stored attempt number. Null only if the run was never numbered (a broken invariant). When Korala decides automatically it then records data.attempt_unnumbered: an approval or resubmission goes to review with the code in codes, a review gains it in codes, and beside a definite decline it sits in findings (not codes) while the decline stands. With no automatic decision there is no record. A reviewer's or partner's decision stands and simply cites null. A decision an older version of Korala made cites that version's attempt counter.
      - `resubmission` SessionDecisionResubmissionDto
        - `sessionWorkflowId` string, required: The earliest workflow the person is asked to redo
        - `attemptsRemaining` number, required: The fewest attempts the person has left on any workflow asked for again
        - `workflows` SessionDecisionResubmissionWorkflowDto[]: Every workflow asked for again, earliest first
          - `sessionWorkflowId` string, required: A workflow the person is asked to redo
          - `attemptsRemaining` number, required: Attempts the person has left on it
      - `identityAcrossAttempts` SessionDecisionIdentityAcrossAttemptsDto
        - `status` 'same' | 'changed' | 'unknown', required: changed: a different person (code duplicate.identity_changed_between_attempts; the switch itself never declines, while a definite decline from a check set to block still declines, with the switch among decision.codes); unknown: a field either attempt left unread, so not compared; same: name and date of birth agree
        - `signals` string[], required: What showed a change: name_and_date_of_birth, both differ; document_number, another document (number and issuing country) whose name differs while the date of birth is not shown to agree (unread on either); document_and_date_of_birth, another document with another date of birth, whatever the name (two people of one name)
    - `metadata` object, nullable
    - `context` object, nullable
    - `accumulatedData` object, nullable
    - `expiresAt` string, date-time, nullable
    - `redirectUrl` string, nullable
    - `startedAt` string, date-time, nullable
    - `completedAt` string, date-time, nullable
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `total` number, required
  - `page` number, required
  - `limit` number, required
  - `totalPages` number, required

---

[API](https://skmtc.dev/korala/apis/korala-public-api.md) · [All operations](https://skmtc.dev/korala/apis/korala-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/korala/apis/korala-public-api/revisions/5c4d7810c507?raw)