---
title: "List app user sessions"
method: GET
path: "/v1/spaces/{spaceId}/users/{userId}/sessions"
tags: ["Spaces"]
---

# List app user sessions

`GET /v1/spaces/{spaceId}/users/{userId}/sessions`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/users/{userId}/sessions`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://api.spacefast.com/v1/auth/oauth2/authorize`, token URL `https://api.spacefast.com/v1/auth/oauth2/token`; client credentials, token URL `https://api.spacefast.com/v1/auth/oauth2/token`, scopes: `spaces:write`)

Lists the app sign-in sessions of one visitor account: label, created and expiry times, and when each was revoked. Never returns session credentials. App accounts sign in to the published Space only; they never grant team or Space access. Requires permission to manage the Space.

## Path parameters

- `spaceId` string, required
- `userId` integer, required

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required
    - `sessions` object[], required
      - `id` string, required
      - `label` string, required
      - `createdAt` integer, required
      - `expiresAt` integer, required
      - `revokedAt` integer, nullable, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)