Sessions
GET /v1/auth/session, GET /session/list, DELETE /session/others and DELETE /session/:sid — plus cursor pagination.
Sessions are the devices that are signed in. This group covers "what am I holding right now", "what else is signed in", and two ways to sign the others out.
Endpoints
| Method | Path | Purpose | Step-up |
|---|---|---|---|
GET | /v1/auth/session | Current session | None |
GET | /v1/auth/session/list | List all sessions | None |
DELETE | /v1/auth/session/others | Sign out every other device | max_age=300 |
DELETE | /v1/auth/session/:sid | Sign out a specific session | max_age=300 |
GET /session
No parameters. The session token in the Bearer header is the session being described.
{
"success": true,
"session": {
"id": "ses_...",
"did": "device-8f3a1c2b",
"user_agent": "Mozilla/5.0 ...",
"ip": "203.0.113.7",
"country": "JP",
"acr": "urn:muoceon:acr:aal2",
"auth_time": "2026-11-14T08:31:12.000Z",
"created_at": "2026-11-14T08:31:12.000Z",
"last_seen_at": "2026-11-14T09:02:41.000Z",
"is_current": true
}
}GET /session/list
| Query | Type | Required | Notes |
|---|---|---|---|
limit | number | Optional | Default 20, max 100 |
cursor | string | Optional | next_cursor from the previous page |
{
"success": true,
"sessions": [
{
"id": "ses_...",
"did": "device-8f3a1c2b",
"user_agent": "Mozilla/5.0 ...",
"ip": "203.0.113.7",
"country": "JP",
"created_at": "2026-11-14T08:31:12.000Z",
"last_seen_at": "2026-11-14T09:02:41.000Z",
"is_current": true
}
],
"next_cursor": null
}is_current marks the session that is issuing this request, so the UI can label it and avoid offering "sign this one out" next to it.
Cursor, not offset
The session list changes while the user is reading it — a device comes online, another is signed out. Offset pagination would then repeat entries or skip them. The cursor encodes "where we stopped", so the next page is continuous even after the list shifted.
DELETE /session/others
No parameters. Signs out every session except the current one.
{ "success": true, "message": "3 session(s) signed out", "revoked": 3 }This is the "I think someone else is in my account" button. It deliberately keeps the current session alive: the user is acting from it, and signing it out would leave them staring at a broken page.
DELETE /session/:sid
| Parameter | Location | Required | Notes |
|---|---|---|---|
sid | path | ✅ | Session id to sign out |
Targeting the current session is allowed and signs the caller out too. Both delete endpoints require max_age=300: a session that is not actually yours can only be removed by someone who has just proven they are the account holder.
Related
- Token refresh and revocation: Tokens
- Step-up: Session elevation
- Revoking an application's access: Authorized applications