identity

Extend a Session

Changed on Nov 7, 2025

Calling this endpoint extends the given session ID. If session.earliest_possible_extend is set it will only extend the session after the specified time has passed.

This endpoint returns per default a 204 No Content response on success. Older Ory Network projects may return a 200 OK response with the session in the body. Returning the session as part of the response will be deprecated in the future and should not be relied upon.

This endpoint ignores consecutive requests to extend the same session and returns a 404 error in those scenarios. This endpoint also returns 404 errors if the session does not exist.

Retrieve the session ID from the /sessions/whoami endpoint / toSession SDK method.

patch/admin/sessions/{id}/extend

Request

Base URL
/ (relative, and the document was published on a file host, not at the API’s origin)
URL
/admin/sessions/{id}/extend
Auth
API key in header Authorization

Path parameters

idstring required

ID is the session's ID.

Response

session

activeboolean

Active state. If false the session is no longer active.

authenticated_atstring date-time

The Session Authentication Timestamp

When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code challenge was completed).

authenticator_assurance_level'aal0' | 'aal1' | 'aal2' | 'aal3'

The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account.

Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g. password + TOTP) have been used.

To learn more about these levels please head over to: https://www.ory.sh/kratos/docs/concepts/credentials

expires_atstring date-time

The Session Expiry

When this session expires at.

idstring uuid required

Session ID

issued_atstring date-time

The Session Issuance Timestamp

When this session was issued at. Usually equal or close to authenticated_at.

tokenizedstring

Tokenized is the tokenized (e.g. JWT) version of the session.

It is only set when the tokenize_as query parameter was set to a valid tokenize template during calls to /session/whoami.

Example response

{
  "tokenized": "tokenized",
  "expires_at": "2000-01-23T04:56:07.000+00:00",
  "devices": [
    {
      "location": "location",
      "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
      "ip_address": "ip_address",
      "user_agent": "user_agent"
    },
    {
      "location": "location",
      "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
      "ip_address": "ip_address",
      "user_agent": "user_agent"
    }
  ],
  "authentication_methods": [
    {
      "completed_at": "2000-01-23T04:56:07.000+00:00",
      "method": "password",
      "provider": "provider",
      "organization": "organization",
      "aal": "aal0"
    },
    {
      "completed_at": "2000-01-23T04:56:07.000+00:00",
      "method": "password",
      "provider": "provider",
      "organization": "organization",
      "aal": "aal0"
    }
  ],
  "authenticator_assurance_level": null,
  "identity": {
    "traits": "",
    "credentials": {
      "key": {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "identifiers": [
          "identifiers",
          "identifiers"
        ],
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "type": "password",
        "config": "{}",
        "version": 0
      }
    },
    "state_changed_at": "2000-01-23T04:56:07.000+00:00",
    "created_at": "2000-01-23T04:56:07.000+00:00",
    "external_id": "external_id",
    "recovery_addresses": [
      {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "via": "via"
      },
      {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "via": "via"
      }
    ],
    "metadata_admin": "",
    "updated_at": "2000-01-23T04:56:07.000+00:00",
    "verifiable_addresses": [
      {
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified_at": "2000-01-23T04:56:07.000+00:00",
        "verified": true,
        "created_at": "2014-01-01T23:28:56.782Z",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "status": "status",
        "via": "email"
      },
      {
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified_at": "2000-01-23T04:56:07.000+00:00",
        "verified": true,
        "created_at": "2014-01-01T23:28:56.782Z",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "status": "status",
        "via": "email"
      }
    ],
    "organization_id": "organization_id",
    "schema_id": "schema_id",
    "schema_url": "schema_url",
    "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
    "state": "active",
    "metadata_public": ""
  },
  "authenticated_at": "2000-01-23T04:56:07.000+00:00",
  "active": true,
  "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
  "issued_at": "2000-01-23T04:56:07.000+00:00"
}

Changes

Nov 7, 20255f08e5827b5e Revision changes
- breaking
  the response property /// became optional for the status
- warning
  added the new passkey enum value to the // response property for the response status
- warning
  added the new profile enum value to the // response property for the response status
- warning
  added the new saml enum value to the // response property for the response status
- info
  added the optional property / to the response with the status
- info
  removed the v0.6_legacy_session enum value from the // response property for the response status
Feb 25, 2025df2fe8db7397 Revision changes
- warning
  added the new saml enum value to the /// response property for the response status
- info
  added the success response with the status

Operation history (8 revisions)