---
title: "Get"
method: GET
path: "/v1/b2b/sessions"
tags: ["Session"]
---

# Get

`GET /v1/b2b/sessions`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/b2b/sessions`
- Auth: HTTP basic

Retrieves all active Sessions for a Member.

## Query parameters

- `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.
- `member_id` string, required: Globally unique UUID that identifies a specific Member. The `member_id` is critical to perform operations on a Member, so be sure to preserve this value. You may use an external_id here if one is set for the member.

## Response `200`

Successful response

- ApiB2bSessionV1GetResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `member_sessions` ApiB2bSessionV1MemberSession[], required: An array of [Session objects](https://stytch.com/docs/b2b/api/session-object).
    - `member_session_id` string, required: Globally unique UUID that identifies a specific Session.
    - `member_id` string, required: Globally unique UUID that identifies a specific Member.
    - `started_at` string, required: The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
    - `last_accessed_at` string, required: The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
    - `expires_at` string, required: The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
    - `authentication_factors` ApiSessionV1AuthenticationFactor[], required: An array of different authentication factors that comprise a Session.
      - `type` 'magic_link' | 'otp' | 'oauth' | 'webauthn' | 'totp' | 'crypto' | 'password' | 'signature_challenge' | 'sso' | 'imported' | 'recovery_codes' | 'email_otp' | 'impersonated' | 'trusted_auth_token', required
      - `delivery_method` 'email' | 'sms' | 'whatsapp' | 'embedded' | 'oauth_google' | 'oauth_microsoft' | 'oauth_apple' | 'webauthn_registration' | 'authenticator_app' | 'oauth_github' | 'recovery_code' | 'oauth_facebook' | 'crypto_wallet' | 'oauth_amazon' | 'oauth_bitbucket' | 'oauth_coinbase' | 'oauth_discord' | 'oauth_figma' | 'oauth_gitlab' | 'oauth_instagram' | 'oauth_linkedin' | 'oauth_shopify' | 'oauth_slack' | 'oauth_snapchat' | 'oauth_spotify' | 'oauth_steam' | 'oauth_tiktok' | 'oauth_twitch' | 'oauth_twitter' | 'knowledge' | 'biometric' | 'sso_saml' | 'sso_oidc' | 'oauth_salesforce' | 'oauth_yahoo' | 'oauth_hubspot' | 'imported_auth0' | 'oauth_exchange_slack' | 'oauth_exchange_hubspot' | 'oauth_exchange_github' | 'oauth_exchange_google' | 'impersonation' | 'oauth_access_token_exchange' | 'trusted_token_exchange', required
      - `last_authenticated_at` string: The timestamp when the factor was last authenticated.
      - `created_at` string: The timestamp when the factor was initially authenticated.
      - `updated_at` string: The timestamp when the factor was last updated.
      - `email_factor` ApiSessionV1EmailFactor
        - `email_id` string, required: The globally unique UUID of the Member's email.
        - `email_address` string, required: The email address of the Member.
      - `phone_number_factor` ApiSessionV1PhoneNumberFactor
        - `phone_id` string, required: The globally unique UUID of the Member's phone number.
        - `phone_number` string, required: The phone number of the Member.
      - `google_oauth_factor` ApiSessionV1GoogleOAuthFactor
        - `id` string, required: The unique ID of an OAuth registration.
        - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
        - `email_id` string: The globally unique UUID of the Member's email.
      - `microsoft_oauth_factor` ApiSessionV1MicrosoftOAuthFactor
        - `id` string, required: The unique ID of an OAuth registration.
        - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
        - `email_id` string: The globally unique UUID of the Member's email.
      - `apple_oauth_factor` ApiSessionV1AppleOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `webauthn_factor` ApiSessionV1WebAuthnFactor
        - `webauthn_registration_id` string, required
        - `domain` string, required
        - `user_agent` string
      - `authenticator_app_factor` ApiSessionV1AuthenticatorAppFactor
        - `totp_id` string, required: Globally unique UUID that identifies a TOTP instance.
      - `github_oauth_factor` ApiSessionV1GithubOAuthFactor
        - `id` string, required: The unique ID of an OAuth registration.
        - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
        - `email_id` string: The globally unique UUID of the Member's email.
      - `recovery_code_factor` ApiSessionV1RecoveryCodeFactor
        - `totp_recovery_code_id` string, required
      - `facebook_oauth_factor` ApiSessionV1FacebookOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `crypto_wallet_factor` ApiSessionV1CryptoWalletFactor
        - `crypto_wallet_id` string, required
        - `crypto_wallet_address` string, required
        - `crypto_wallet_type` string, required
      - `amazon_oauth_factor` ApiSessionV1AmazonOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `bitbucket_oauth_factor` ApiSessionV1BitbucketOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `coinbase_oauth_factor` ApiSessionV1CoinbaseOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `discord_oauth_factor` ApiSessionV1DiscordOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `figma_oauth_factor` ApiSessionV1FigmaOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `git_lab_oauth_factor` ApiSessionV1GitLabOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `instagram_oauth_factor` ApiSessionV1InstagramOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `linked_in_oauth_factor` ApiSessionV1LinkedInOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `shopify_oauth_factor` ApiSessionV1ShopifyOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `slack_oauth_factor` ApiSessionV1SlackOAuthFactor
        - `id` string, required: The unique ID of an OAuth registration.
        - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
        - `email_id` string: The globally unique UUID of the Member's email.
      - `snapchat_oauth_factor` ApiSessionV1SnapchatOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `spotify_oauth_factor` ApiSessionV1SpotifyOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `steam_oauth_factor` ApiSessionV1SteamOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `tik_tok_oauth_factor` ApiSessionV1TikTokOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `twitch_oauth_factor` ApiSessionV1TwitchOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `twitter_oauth_factor` ApiSessionV1TwitterOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `embeddable_magic_link_factor` ApiSessionV1EmbeddableMagicLinkFactor
        - `embedded_id` string, required
      - `biometric_factor` ApiSessionV1BiometricFactor
        - `biometric_registration_id` string, required
      - `saml_sso_factor` ApiSessionV1SAMLSSOFactor
        - `id` string, required: The unique ID of an SSO Registration.
        - `provider_id` string, required: Globally unique UUID that identifies a specific SAML Connection.
        - `external_id` string, required: The ID of the member given by the identity provider.
      - `oidc_sso_factor` ApiSessionV1OIDCSSOFactor
        - `id` string, required: The unique ID of an SSO Registration.
        - `provider_id` string, required: Globally unique UUID that identifies a specific OIDC Connection.
        - `external_id` string, required: The ID of the member given by the identity provider.
      - `salesforce_oauth_factor` ApiSessionV1SalesforceOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `yahoo_oauth_factor` ApiSessionV1YahooOAuthFactor
        - `id` string, required
        - `provider_subject` string, required
        - `email_id` string
      - `hubspot_oauth_factor` ApiSessionV1HubspotOAuthFactor
        - `id` string, required: The unique ID of an OAuth registration.
        - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
        - `email_id` string: The globally unique UUID of the Member's email.
      - `slack_oauth_exchange_factor` ApiSessionV1SlackOAuthExchangeFactor
        - `email_id` string, required: The globally unique UUID of the Member's email.
      - `hubspot_oauth_exchange_factor` ApiSessionV1HubspotOAuthExchangeFactor
        - `email_id` string, required: The globally unique UUID of the Member's email.
      - `github_oauth_exchange_factor` ApiSessionV1GithubOAuthExchangeFactor
        - `email_id` string, required: The globally unique UUID of the Member's email.
      - `google_oauth_exchange_factor` ApiSessionV1GoogleOAuthExchangeFactor
        - `email_id` string, required: The globally unique UUID of the Member's email.
      - `impersonated_factor` ApiSessionV1ImpersonatedFactor
        - `impersonator_id` string, required: For impersonated sessions initiated via the Stytch Dashboard, the `impersonator_id` will be the impersonator's Stytch Dashboard `member_id`.
        - `impersonator_email_address` string, required: The email address of the impersonator.
      - `oauth_access_token_exchange_factor` ApiSessionV1OAuthAccessTokenExchangeFactor
        - `client_id` string, required: The ID of the Connected App client.
      - `trusted_auth_token_factor` ApiSessionV1TrustedAuthTokenFactor
        - `token_id` string, required: The ID of the trusted auth token.
    - `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value.
    - `roles` string[], required
    - `organization_slug` string, required: The unique URL slug of the Organization. The slug only accepts alphanumeric characters and the following reserved characters: `-` `.` `_` `~`. Must be between 2 and 128 characters in length. Wherever an organization_id is expected in a path or request parameter, you may also use the organization_slug as a convenience.
    - `custom_claims` object: The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2026-01-09** `7dfcc14e566c`: 1 breaking
  - the `member_sessions/items/custom_claims` response's property type changed from `string` to `object` for status `200`
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`
- **2025-09-17** `25964b4a5e32`: 1 info
  - api operation id `api_multitenant_session_v1_Get` removed and replaced with `api_b2b_session_v1_Get`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/b2b/sessions/get.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)