List an organization's active sessions (admin)

GET/v1/admin/orgs/{slug}/sessions

Returns one page of the sign-in sessions that are active in slug's organization, using opaque cursor (keyset) pagination. Bound the page size with limit and choose an ordering with sort (see x-sort-fields for what this endpoint accepts; the session id is appended so the ordering is total). Then walk the listing by passing the previous response's page.next_cursor back as cursor for as long as page.has_more is true; page.prev_cursor steps back the same way. Defaults to newest sign-in first.

Which sessions are active. A session is listed while it would still sign its user in: before its absolute expiry, and no longer idle than the idle timeout allows — the same rule the server applies when the session is presented. A session that has already died is never listed, whether or not it has been swept yet. Sessions that have ended are not part of this listing.

user_id narrows the listing to one user's sessions and client_id to the sessions a client took part in; they compose as a conjunction. A cursor is bound to the filters it was issued for, so send them with it; the order it carries itself.

Each session carries its public id — the sid its relying parties receive — and never the credential its browser holds or anything derived from it. The user's display name, and the address and user agent the session was established from, are personal data: a caller without the users.pii.read permission receives none of them, and each session names what it withheld in withheld.

Reading the listing is audited. Requires the nauthera.sessions:read scope and the sessions.read permission; the listing is confined to slug's organization.

GET/v1/admin/orgs/{slug}/sessions

curl -g 'https://auth.example.com/v1/admin/orgs/{slug}/sessions' \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

200 OK

{
  "items": [
    {
      "id": "string",
      "user_id": "string",
      "username": "string",
      "created_at": "2026-01-15T09:30:00Z",
      "auth_time": "2026-01-15T09:30:00Z",
      "last_seen_at": "2026-01-15T09:30:00Z",
      "idle_expires_at": "2026-01-15T09:30:00Z",
      "expires_at": "2026-01-15T09:30:00Z",
      "amr": [
        "string"
      ],
      "client_ids": [
        "string"
      ],
      "withheld": [
        "display_name"
      ]
    }
  ],
  "page": {
    "limit": 50,
    "sort": "last_name,-first_name,id",
    "has_more": false,
    "has_prev": false
  }
}

Authorization

Bearer tokenOAuth 2.0nauthera.sessions:read

The access token must carry the scope shown.

Send it in the Authorization header:

The access token, as Bearer <token> (RFC 6750 §2.1) or, for a sender-constrained token, DPoP <token> (RFC 9449 §7.1). A token minted with a cnf.jkt confirmation is only accepted together with a DPoP proof signed by that key, whichever of the two schemes carries it.

The caller must also hold the permission sessions.read: Read users' sessions.

Path parameters

slugstringrequired
The organization slug. It names the TENANT OF RECORD for the operation: the rows it reads and writes, the policy its secrets are derived under, and the organization its audit record is filed against all come from this organization. A token is admitted only through its own slug, except a main-org token, which may be admitted through any — so cross-tenant administration is performed through the TARGET tenant's slug, never by naming its resources through another. A token reaching for a slug it may not be admitted through is refused identically whether that organization exists or not.
1–64 characters

Query parameters

limitinteger
Maximum number of items to return in one page (1–200; default 50). A value outside that range is rejected with a 400. It may be changed freely between pages of the same walk — a cursor marks a position, not a page number.
Default50
between 1 and 200
sortstring
Ordering for the listing: a comma-separated list of fields, most significant first, a leading - marking a descending term. For example sort=last_name,-first_name sorts by last name ascending, then by first name descending.
Show moreShow less
Which fields a given endpoint accepts is listed in its x-sort-fields extension; naming anything else is a 400. A field may appear only once.

The server always appends the resource's primary key as a final term, so the ordering is TOTAL — rows that tie on every field you named still have a defined relative order, without which a page could skip or repeat them. The full ordering, including that appended term, is echoed as page.sort.

Send it on the FIRST request of a walk only: every cursor records the ordering it was issued under, so it carries forward automatically, and a sort that contradicts the supplied cursor is rejected with a 400 rather than silently reordering mid-walk.
Sortable fields: created_at, id. Prefix a field with - to sort descending.
at most 256 characters · pattern ^-?[a-z][a-z0-9_]*(,-?[a-z][a-z0-9_]*)*$
cursorstring
Opaque keyset cursor identifying where a page begins. Omit it for the first page; afterwards pass the next_cursor (or prev_cursor) value from the previous response verbatim — the token itself records which direction it steps in, so there is no separate direction parameter.
Show moreShow less
The token is server-defined and MUST be treated as opaque: it is bound to the listing and sort order that issued it, and a cursor that is malformed, tampered with, or belongs to a different listing or order is rejected with a 400 rather than silently paging through the wrong set.
at most 1024 characters
user_idstring
Only the sessions of the user with this id.
at most 256 characters
client_idstring
Only the sessions the client with this OAuth client id took part in.
at most 256 characters

Headers

DPoPstring
DPoP proof JWT (RFC 9449 §4). REQUIRED on a request presenting a DPoP-bound access token, and it must be signed by the key named in the token's cnf.jkt and cover this request's method and URI. The proof is read from the request itself rather than from this decoded parameter, so every protected operation is covered whether or not it declares it.

Responses

200 OKapplication/jsonOne page of the organization's active sessions.
One page of the organization's active sessions.
Headers
- Cache-Controlno-store
Body
One page of an organization's active sessions under cursor (keyset) pagination: items holds the page, ordered by the request's sort, and page says where it sits in the listing. Follow page.next_cursor while page.has_more is true.
- itemsarray of objectsrequired
  The sessions on this page.
  Each item:
  An active sign-in session as the admin API lists it: whose it is, when it began and was last used, how its user authenticated, the clients that took part in it, and when it ends.
  Show moreShow less
  id is the session's PUBLIC identifier — the sid its relying parties receive in ID and logout tokens, and the session_id its audit records carry. The credential the browser holds, and anything derived from it, is never returned.
  Show item attributesHide item attributes
  idstringrequired
  The public session id: the sid claim of every ID token issued in this session.
  user_idstringrequired
  The id of the user the session belongs to.
  usernamestringrequired
  The user's username within the organization.
  created_atstring · date-timerequired
  When the user signed in and the session began.
  auth_timestring · date-timerequired
  When the user last authenticated in this session (OIDC auth_time).
  last_seen_atstring · date-timerequired
  When the session was last used. Refreshed lazily, so it may trail the most recent use by up to a minute.
  idle_expires_atstring · date-timerequired
  When the session ends if it is not used again: last_seen_at plus the idle timeout. The session ends at whichever of this and expires_at comes first.
  expires_atstring · date-timerequired
  When the session ends however it is used: its absolute lifetime, fixed when it began.
  amrarray of stringsrequired
  The authentication methods the user satisfied (OIDC amr, RFC 8176), such as pwd, otp and mfa.
  client_idsarray of stringsrequired
  The OAuth client ids of the clients that took part in the session — each was issued an authorization code in it — sorted. Empty when none has yet.
  withheldarray of enumsrequired
  The personal fields left out of this session because the caller lacks the users.pii.read permission, in a fixed order; empty when nothing was withheld. A field named here is absent because it was withheld, not because it is unknown.
  Each item:
  A personal field of a session that was left out because the caller lacks the users.pii.read permission: the user's display name, the address the session was established from, or its user agent.
  Possible values"display_name""ip""user_agent"
  display_namestring
  The user's display name. Absent when they have none, or when it was withheld (see withheld).
  acrstring
  The authentication context class satisfied (OIDC acr). Absent when none was recorded.
  ipstring
  The address the session was established from. Absent when it was not recorded, or when it was withheld (see withheld).
  user_agentstring
  The user agent the session was established from. Absent when it was not recorded, or when it was withheld (see withheld).
- pageobjectrequired
  Where one page sits in a cursor (keyset) paginated list, returned beside that page's items.
  Show moreShow less
  Walk a list by following next_cursor for as long as has_more is true, passing the token back verbatim as the cursor query parameter. Keep the listing and its filters the same for the whole walk; limit MAY change between pages (a cursor marks a position, not a page number), and sort travels in the cursor so it need not be resent. has_more is authoritative: it is derived from whether a further row actually exists, so a page that happens to be full is not mistaken for a page that has a successor, and a walk never costs a trailing empty request. prev_cursor steps back the same way.
  
  A cursor is opaque — server-defined, bound to this listing and sort order, and not parseable by clients. It stays valid across page-size changes but not across a change of sort order or filters; a cursor that does not belong to the request is rejected with a 400 rather than silently paging through the wrong set.
  
  Keyset paging is stable under concurrent writes, with one qualification. A row whose SORT KEY does not change is returned exactly once for the whole walk. Rows created or deleted mid-walk may or may not appear, depending on which side of the cursor they fall — and so may a row whose sort key is UPDATED mid-walk, since that moves it across the boundary: it can be seen twice or missed. Sorting by a field that does not change (the default id ordering, or created_at) avoids this entirely.
  Show child attributesHide child attributes
  limitintegerrequired
  The page size in effect: the limit that was sent, or the server's default when it was omitted. Echoed so a client resuming from a stored cursor knows the page size without having to remember it.
  Example50
  sortstringrequired
  The ordering this walk is pinned to, in the sort parameter's syntax and INCLUDING the primary-key term the server appends to make it total. Cursors carry it, so it need only be sent on the first request.
  Example"last_name,-first_name,id"
  has_morebooleanrequired
  Whether a page follows this one and next_cursor can reach it. When false this is the last page and next_cursor is absent.
  has_prevbooleanrequired
  Whether a page precedes this one and prev_cursor can reach it. False on the first page of a walk.
  Show moreShow less
  Both flags report REACHABILITY, not bare existence. A cursor that overshoots the set — a stale bookmark, or rows deleted mid-walk — returns an empty page with both flags false even though rows precede it, because an empty page has no row to anchor a cursor on. Restart the walk if you land there; a client following has_more never does.
  next_cursorstring
  Opaque cursor for the next page. Present exactly when has_more is true, and ABSENT (the field is omitted, not null) otherwise. Pass it back verbatim as the cursor query parameter; never parse it.
  at most 512 characters
  prev_cursorstring
  Opaque cursor for the previous page. Present exactly when has_prev is true, and absent otherwise. Passed back as cursor, exactly like next_cursor — the token itself records which way it steps.
  at most 512 characters
400 Bad Requestapplication/problem+jsonThe pagination parameters or a filter were invalid — a malformed or foreign cursor, a cursor contradicting sort, a sort naming a field this endpoint does not accept or naming one twice, a limit outside its declared range, or a filter longer than its declared length.
The pagination parameters or a filter were invalid — a malformed or foreign cursor, a cursor contradicting sort, a sort naming a field this endpoint does not accept or naming one twice, a limit outside its declared range, or a filter longer than its declared length.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
401 Unauthorizedapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
403 Forbiddenapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
429 Too Many Requestsapplication/problem+jsonToo many requests.
Too many requests.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
Errorapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"

PreviousEnd every session of a user NextEnd one session

List an organization's active sessions (admin)

GET/v1/admin/orgs/{slug}/sessions

Reading the listing is audited. Requires the nauthera.sessions:read scope and the sessions.read permission; the listing is confined to slug's organization.

Headers

Body

Body

Headers

Body

Headers

Body

Body

Headers

Body

Headers

Body

Body

Headers

Body

Headers

Body

Body

Headers

Body