/sessions

3 routes.

Sign-ins on this account, with the key or app that owns each.

• GET /v1/sessions
• POST /v1/sessions/sign-out-others
• DELETE /v1/sessions/{id}

GET /v1/sessions

List sessions

The account’s sign-in sessions, each with the key or connected app that owns it, and with the ENROLLED DEVICE that signed in with it: device, deviceType and lastActiveAt. ⚠ The device’s name and platform are end-to-end encrypted, so a first-party app session, which carries no key here, reads them as null plus an envelope and sees deviceType: "unknown"; the apps hold the key on the device and derive both themselves. No IP addresses.

Scopes: sessions:read

Response

• 200 SessionList. Every session. Not cursor-paged in practice: next_cursor is always null.

Errors: grant_expired * grant_revoked * unauthorized * forbidden_scope * rate_limited * internal

POST /v1/sessions/sign-out-others

Sign out every other device (app session only)

What an app’s “also sign out my other devices” calls after a password change. Ends every session of the account except the caller’s own and the ones behind access keys and connected apps, which keep working. The server decides which those are from its own record of the sessions it created for them; nothing a client sends or stores is consulted. Callable only with a first-party app session (an access key or a connected app is refused with forbidden_scope). At most 10 an hour.

Scopes: any valid credential First-party only. Not callable with an access key or an OAuth token, whatever scopes it holds.

Response

• 200 SignOutOthersResult. How many sessions were ended and kept.

Errors: grant_expired * grant_revoked * unauthorized * forbidden_scope * payload_too_large * unsupported_media_type * rate_limited * internal

DELETE /v1/sessions/{id}

End a session

current is refused as an id: signing the caller out as a side effect of a path segment is the app’s job, not this route’s.

Scopes: sessions:write

Response

• 204 No body. Ended.

Errors: grant_expired * grant_revoked * unauthorized * forbidden_scope * not_found * validation_failed * rate_limited * internal