ORory
identity

Extend a Session

Calling this endpoint extends the given session ID. If session.earliest_possible_extend is set it will only extend the session after the specified time has passed.

This endpoint returns per default a 204 No Content response on success. Older Ory Network projects may return a 200 OK response with the session in the body. Returning the session as part of the response will be deprecated in the future and should not be relied upon.

This endpoint ignores consecutive requests to extend the same session and returns a 404 error in those scenarios. This endpoint also returns 404 errors if the session does not exist.

Retrieve the session ID from the /sessions/whoami endpoint / toSession SDK method.

patch/admin/sessions/{id}/extend

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /admin/sessions/{id}/extend
  • Auth
    API key in header Authorization

Path parameters

idstring required

ID is the session's ID.

Response

session

activeboolean

Active state. If false the session is no longer active.

authenticated_atstring date-time

The Session Authentication Timestamp

When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code challenge was completed).

authenticator_assurance_levelstring

The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account.

Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g. password + TOTP) have been used.

To learn more about these levels please head over to: https://www.ory.com/kratos/docs/concepts/credentials

expires_atstring date-time

The Session Expiry

When this session expires at.

idstring uuid required

Session ID

issued_atstring date-time

The Session Issuance Timestamp

When this session was issued at. Usually equal or close to authenticated_at.

tokenizedstring

Tokenized is the tokenized (e.g. JWT) version of the session.

It is only set when the tokenize_as query parameter was set to a valid tokenize template during calls to /session/whoami.

Example response

{
  "identity": {
    "verifiable_addresses": [
      {
        "created_at": "2014-01-01T23:28:56.782Z",
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified": true,
        "via": "email"
      }
    ]
  }
}

Changes

No recorded changes to this operation across all 65 revisions of this API.