---
title: "List a user's sessions"
method: GET
path: "/admin/users/{userId}/sessions"
tags: ["Admin"]
---

# List a user's sessions

`GET /admin/users/{userId}/sessions`

## Request

- Base URL: `https://cloud.kaneo.app/api`
- URL: `https://cloud.kaneo.app/api/admin/users/{userId}/sessions`
- Auth: HTTP bearer

List a user's signed-in sessions with device, IP address, and activity. Tokens are never returned. `current` marks the administrator's own session. Requires the `users:sessions` instance permission; API keys are rejected.

## Path parameters

- `userId` string, required

## Response `200`

Active sessions

- ActiveSessionList
  - `sessions` ActiveSession[], required
    - `id` string, required: Session id. Session tokens are never returned.
    - `browser` string, nullable, required: Browser read from the session's user agent, if known.
    - `os` string, nullable, required: Operating system or device read from the user agent.
    - `ipAddress` string, nullable, required
    - `createdAt` string, date-time, required
    - `lastActiveAt` string, date-time, required: When the session was last refreshed. Sessions refresh about once a day while in use.
    - `expiresAt` string, date-time, required
    - `current` boolean, required: True for the session making this request.

## Other responses

- `401`: Missing or invalid credentials
- `403`: The caller lacks the instance permission or is authenticated with an API key
- `404`: User not found
- `429`: The API key exceeded its rate limit or usage quota. Wait the number of seconds in Retry-After before retrying. The X-RateLimit headers are sent only when the rate limit was hit.

## Changes

- **2026-10-27** `bbaae0ea62c6`: 1 info
  - endpoint added
- **2026-10-27** `d7d92f47083a`: 1 breaking
  - api path removed without deprecation
- **2026-10-27** `720626ed550f`: 1 info
  - endpoint added
- **2026-10-26** `270c2866a46a`: 1 breaking
  - api path removed without deprecation
- **2026-10-26** `8cf55c967f4c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/usekaneo/apis/kaneo-api/changes/admin/users/:userId/sessions/get.md)

---

[API](https://skmtc.dev/usekaneo/apis/kaneo-api.md) - [All operations](https://skmtc.dev/usekaneo/apis/kaneo-api/llms.txt) - [OpenAPI document](https://skmtc.dev/usekaneo/apis/kaneo-api/revisions/741a49dfb347?raw)