---
title: "This endpoints returns all other active sessions that belong to the logged-in user. The current session can be retrieved by calling the `/sessions/whoami` endpoint."
method: GET
path: "/sessions"
tags: ["v0alpha2"]
---

# This endpoints returns all other active sessions that belong to the logged-in user. The current session can be retrieved by calling the \`/sessions/whoami\` endpoint.

`GET /sessions`

This endpoint is useful for:

Displaying all other sessions that belong to the logged-in user

## Query parameters

- `per_page` integer
- `page` integer

## Headers

- `X-Session-Token` string
- `Cookie` string

## Response `200`

sessionList

- Session[]
  - `active` boolean — Active state. If false the session is no longer active.
  - `authenticated_at` string, date-time — The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code challenge was completed).
  - `authentication_methods` SessionAuthenticationMethod[] — A list of authenticators which were used to authenticate the session.
    - `aal` 'aal0' | 'aal1' | 'aal2' | 'aal3' — The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g. password + TOTP) have been used. To learn more about these levels please head over to: https://www.ory.sh/kratos/docs/concepts/credentials
    - `completed_at` string, date-time — When the authentication challenge was completed.
    - `method` 'link_recovery' | 'password' | 'totp' | 'oidc' | 'webauthn' | 'lookup_secret'
  - `authenticator_assurance_level` 'aal0' | 'aal1' | 'aal2' | 'aal3' — The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g. password + TOTP) have been used. To learn more about these levels please head over to: https://www.ory.sh/kratos/docs/concepts/credentials
  - `expires_at` string, date-time — The Session Expiry When this session expires at.
  - `id` string, uuid4, required
  - `identity` Identity, required — An identity can be a real human, a service, an IoT device - everything that can be described as an "actor" in a system.
    - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
    - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
    - `id` string, uuid4, required
    - `recovery_addresses` RecoveryAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `id` string, uuid4, required
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `value` string, required
      - `via` string, required
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `state` 'active' | 'inactive' — The state can either be `active` or `inactive`.
    - `state_changed_at` string, date-time
    - `traits` unknown, required
    - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
    - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `created_at` string, date-time — When this entry was created
      - `id` string, uuid4, required
      - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
      - `updated_at` string, date-time — When this entry was last updated
      - `value` string, required — The address value example foo@user.com
      - `verified` boolean, required — Indicates if the address has already been verified
      - `verified_at` string, date-time
      - `via` string, required — VerifiableAddressType must not exceed 16 characters as that is the limitation in the SQL Schema
  - `issued_at` string, date-time — The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`.

## Other responses

- `400` — jsonError
- `401` — jsonError
- `404` — jsonError
- `500` — jsonError

## Changes

- **2022-03-22** `028a4cf83c15` — 1 info
  - endpoint added
- **2021-05-05** `381c760af46e` — 1 breaking
  - api removed without deprecation

[Change history](https://skmtc.dev/ory/apis/ory-identities-api/changes/sessions/get.md)

---

[API](https://skmtc.dev/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-identities-api/revisions/028a4cf83c15/schema)