---
title: "GET /api/ee/session-management"
method: GET
path: "/api/ee/session-management"
tags: ["/api/ee/session-management"]
---

# GET /api/ee/session-management

`GET /api/ee/session-management`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/ee/session-management`
- Auth: API key in header `X-API-Key`

List sessions. By default the ones that are currently live — the ones that would still authenticate a request.
  `status=ended` lists instead the sessions that have ended: revoked, logged out, expired, idle past the session
  timeout, or belonging to a deactivated user or an inactive tenant. An ended session stays on record for thirty
  days, with when and why it ended (`ended_at`, `end_reason`) and who ended it (`ended_by`) once the nightly sweep
  or the ending itself has recorded that; a session that has merely stopped being live since the last sweep is
  already `ended`, with those three null. `status=all` lists both. `total` counts whatever the filters match.

  Superuser only.

## Request body

- object

## Response `2XX`

Successful response

- MetabaseEnterpriseSessionManagementApiSessionsResponse
  - `data` MetabaseEnterpriseSessionManagementApiSession[], required
    - `created_at` string, date-time, required: value must be a valid date/time/datetime
    - `current` boolean, required
    - `device_description` string, nullable, required
    - `device_id` string, nullable, required
    - `end_reason` 'admin' | 'logout' | 'password-change' | 'user-deactivated' | 'tenant-deactivated' | 'sso-logout' | 'support-grant-revoked' | 'expired' | 'timed-out', required
    - `ended_at` string, date-time, nullable, required: value must be a valid date/time/datetime
    - `ended_by` integer, nullable, required: value must be an integer greater than zero.
    - `expires_at` string, date-time, required: value must be a valid date/time/datetime
    - `id` string, required
    - `ip_address` string, nullable, required
    - `last_active_at` string, date-time, nullable, required: value must be a valid date/time/datetime
    - `provider` string, required
    - `status` 'live' | 'ended', required
    - `type` 'normal' | 'full-app-embed', required: How a session was created: an ordinary login, or a full-app embedding one. Derived from whether the `core_session` row carries an anti-CSRF token, which only full-app-embed sessions do.
    - `user` object, required
      - `common_name` string, nullable, required
      - `email` string, required
      - `id` integer, required: value must be an integer greater than zero.
    - `user_agent` string, nullable, required
  - `limit` integer, nullable, required: value must be an integer greater than zero.
  - `offset` integer, nullable, required: value must be an integer greater or equal to than zero.
  - `total` integer, required: value must be an integer greater or equal to than zero.

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/ee/session-management/get.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)