List sessions. By default the ones that are currently live — the ones that would still authenticate a request. status=ended lists instead the sessions that have ended: revoked, logged out, expired, idle past the session timeout, or belonging to a deactivated user or an inactive tenant. An ended session stays on record for thirty days, with when and why it ended (ended_at, end_reason) and who ended it (ended_by) once the nightly sweep or the ending itself has recorded that; a session that has merely stopped being live since the last sweep is already ended, with those three null. status=all lists both. total counts whatever the filters match.

Superuser only.