--- title: "Get" method: GET path: "/v1/sessions" tags: ["Session"] --- # Get `GET /v1/sessions` ## Request - Base URL: `https://api.stytch.com` - URL: `https://api.stytch.com/v1/sessions` - Auth: HTTP basic List all active Sessions for a given `user_id`. All timestamps are formatted according to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. ## Query parameters - `user_id` string, required: The `user_id` to get active Sessions for. You may use an `external_id` here if one is set for the user. ## Response `200` Successful response - ApiSessionV1GetResponse - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue. - `sessions` ApiSessionV1Session[], required: An array of [Session objects](https://stytch.com/docs/api/session-object). - `session_id` string, required: A unique identifier for a specific Session. - `user_id` string, required: The unique ID of the affected User. - `authentication_factors` ApiSessionV1AuthenticationFactor[], required: An array of different authentication factors that comprise a Session. - `type` 'magic_link' | 'otp' | 'oauth' | 'webauthn' | 'totp' | 'crypto' | 'password' | 'signature_challenge' | 'sso' | 'imported' | 'recovery_codes' | 'email_otp' | 'impersonated' | 'trusted_auth_token', required - `delivery_method` 'email' | 'sms' | 'whatsapp' | 'embedded' | 'oauth_google' | 'oauth_microsoft' | 'oauth_apple' | 'webauthn_registration' | 'authenticator_app' | 'oauth_github' | 'recovery_code' | 'oauth_facebook' | 'crypto_wallet' | 'oauth_amazon' | 'oauth_bitbucket' | 'oauth_coinbase' | 'oauth_discord' | 'oauth_figma' | 'oauth_gitlab' | 'oauth_instagram' | 'oauth_linkedin' | 'oauth_shopify' | 'oauth_slack' | 'oauth_snapchat' | 'oauth_spotify' | 'oauth_steam' | 'oauth_tiktok' | 'oauth_twitch' | 'oauth_twitter' | 'knowledge' | 'biometric' | 'sso_saml' | 'sso_oidc' | 'oauth_salesforce' | 'oauth_yahoo' | 'oauth_hubspot' | 'imported_auth0' | 'oauth_exchange_slack' | 'oauth_exchange_hubspot' | 'oauth_exchange_github' | 'oauth_exchange_google' | 'impersonation' | 'oauth_access_token_exchange' | 'trusted_token_exchange', required - `last_authenticated_at` string: The timestamp when the factor was last authenticated. - `created_at` string: The timestamp when the factor was initially authenticated. - `updated_at` string: The timestamp when the factor was last updated. - `email_factor` ApiSessionV1EmailFactor - `email_id` string, required: The globally unique UUID of the Member's email. - `email_address` string, required: The email address of the Member. - `phone_number_factor` ApiSessionV1PhoneNumberFactor - `phone_id` string, required: The globally unique UUID of the Member's phone number. - `phone_number` string, required: The phone number of the Member. - `google_oauth_factor` ApiSessionV1GoogleOAuthFactor - `id` string, required: The unique ID of an OAuth registration. - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols. - `email_id` string: The globally unique UUID of the Member's email. - `microsoft_oauth_factor` ApiSessionV1MicrosoftOAuthFactor - `id` string, required: The unique ID of an OAuth registration. - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols. - `email_id` string: The globally unique UUID of the Member's email. - `apple_oauth_factor` ApiSessionV1AppleOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `webauthn_factor` ApiSessionV1WebAuthnFactor - `webauthn_registration_id` string, required - `domain` string, required - `user_agent` string - `authenticator_app_factor` ApiSessionV1AuthenticatorAppFactor - `totp_id` string, required: Globally unique UUID that identifies a TOTP instance. - `github_oauth_factor` ApiSessionV1GithubOAuthFactor - `id` string, required: The unique ID of an OAuth registration. - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols. - `email_id` string: The globally unique UUID of the Member's email. - `recovery_code_factor` ApiSessionV1RecoveryCodeFactor - `totp_recovery_code_id` string, required - `facebook_oauth_factor` ApiSessionV1FacebookOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `crypto_wallet_factor` ApiSessionV1CryptoWalletFactor - `crypto_wallet_id` string, required - `crypto_wallet_address` string, required - `crypto_wallet_type` string, required - `amazon_oauth_factor` ApiSessionV1AmazonOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `bitbucket_oauth_factor` ApiSessionV1BitbucketOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `coinbase_oauth_factor` ApiSessionV1CoinbaseOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `discord_oauth_factor` ApiSessionV1DiscordOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `figma_oauth_factor` ApiSessionV1FigmaOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `git_lab_oauth_factor` ApiSessionV1GitLabOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `instagram_oauth_factor` ApiSessionV1InstagramOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `linked_in_oauth_factor` ApiSessionV1LinkedInOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `shopify_oauth_factor` ApiSessionV1ShopifyOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `slack_oauth_factor` ApiSessionV1SlackOAuthFactor - `id` string, required: The unique ID of an OAuth registration. - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols. - `email_id` string: The globally unique UUID of the Member's email. - `snapchat_oauth_factor` ApiSessionV1SnapchatOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `spotify_oauth_factor` ApiSessionV1SpotifyOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `steam_oauth_factor` ApiSessionV1SteamOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `tik_tok_oauth_factor` ApiSessionV1TikTokOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `twitch_oauth_factor` ApiSessionV1TwitchOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `twitter_oauth_factor` ApiSessionV1TwitterOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `embeddable_magic_link_factor` ApiSessionV1EmbeddableMagicLinkFactor - `embedded_id` string, required - `biometric_factor` ApiSessionV1BiometricFactor - `biometric_registration_id` string, required - `saml_sso_factor` ApiSessionV1SAMLSSOFactor - `id` string, required: The unique ID of an SSO Registration. - `provider_id` string, required: Globally unique UUID that identifies a specific SAML Connection. - `external_id` string, required: The ID of the member given by the identity provider. - `oidc_sso_factor` ApiSessionV1OIDCSSOFactor - `id` string, required: The unique ID of an SSO Registration. - `provider_id` string, required: Globally unique UUID that identifies a specific OIDC Connection. - `external_id` string, required: The ID of the member given by the identity provider. - `salesforce_oauth_factor` ApiSessionV1SalesforceOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `yahoo_oauth_factor` ApiSessionV1YahooOAuthFactor - `id` string, required - `provider_subject` string, required - `email_id` string - `hubspot_oauth_factor` ApiSessionV1HubspotOAuthFactor - `id` string, required: The unique ID of an OAuth registration. - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols. - `email_id` string: The globally unique UUID of the Member's email. - `slack_oauth_exchange_factor` ApiSessionV1SlackOAuthExchangeFactor - `email_id` string, required: The globally unique UUID of the Member's email. - `hubspot_oauth_exchange_factor` ApiSessionV1HubspotOAuthExchangeFactor - `email_id` string, required: The globally unique UUID of the Member's email. - `github_oauth_exchange_factor` ApiSessionV1GithubOAuthExchangeFactor - `email_id` string, required: The globally unique UUID of the Member's email. - `google_oauth_exchange_factor` ApiSessionV1GoogleOAuthExchangeFactor - `email_id` string, required: The globally unique UUID of the Member's email. - `impersonated_factor` ApiSessionV1ImpersonatedFactor - `impersonator_id` string, required: For impersonated sessions initiated via the Stytch Dashboard, the `impersonator_id` will be the impersonator's Stytch Dashboard `member_id`. - `impersonator_email_address` string, required: The email address of the impersonator. - `oauth_access_token_exchange_factor` ApiSessionV1OAuthAccessTokenExchangeFactor - `client_id` string, required: The ID of the Connected App client. - `trusted_auth_token_factor` ApiSessionV1TrustedAuthTokenFactor - `token_id` string, required: The ID of the trusted auth token. - `roles` string[], required - `started_at` string: The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. - `last_accessed_at` string: The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. - `expires_at` string: The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. - `attributes` ApiAttributeV1Attributes - `ip_address` string: The IP address of the user. - `user_agent` string: The user agent of the User. - `custom_claims` object: The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call. - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors. ## Other responses - `400`: Bad request - `401`: Unauthorized - `429`: Too Many Requests - `500`: Internal server error ## Changes - **2026-03-07** `110f26a94e5b`: 1 info - endpoint added - **2026-03-06** `9cab20b8eca7`: 1 breaking - api path removed without deprecation - **2026-01-09** `7dfcc14e566c`: 1 breaking - the `sessions/items/custom_claims` response's property type changed from `string` to `object` for status `200` - **2025-10-07** `86607f94fcf8`: 1 info - added the required property `sessions/items/roles` to the response with the `200` status - **2025-09-17** `8270cf3a3d4c`: 3 info - added the media type `application/json` for the response with the status `401` - added the media type `application/json` for the response with the status `500` - added the non-success response with the status `429` [Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/sessions/get.md) --- [API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)