Sessions (Admin)
Operator view of every user's active sessions. The user-facing equivalent — list/revoke your own sessions — lives at Self › Sessions.
Scopes
| Scope | Reach |
|---|---|
admin | Listing, reading, deleting sessions. |
admin:read | Reading the session filter metadata. |
The split is intentional — admin:read lets observability/UI roles render filter pickers without granting full session manipulation.
Endpoints
List Sessions
GET /api/admin/sessions/
Returns a page of session records spanning every user.
Required scope: admin · also accepts API key
Query parameters — standard pagination set; see Conventions › Pagination. Defaults: sort_by=created, sort_order=desc. (No hydrate flag on this resource.)
Response 200 — SessionInDbCursorPage
Get Session Filter Metadata
GET /api/admin/sessions/filters
Returns filter/operator/sort options for List Sessions.
Required scope: admin:read
Response 200 — open metadata object.
Get Session by ID
GET /api/admin/sessions/{id}
Returns a single session record.
Required scope: admin · also accepts API key
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
id | string | yes | Session ID. |
Response 200 — SessionRead
Delete Session by ID
DELETE /api/admin/sessions/{id}
Force-revokes a session — the affected user is immediately signed out of that session.
Required scope: admin
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
id | string | yes | Session ID. |
Response 204 — empty.
TIP
Force-revocation is the right tool when a user reports a compromised device or when post-employment offboarding requires immediately ending an account's reach. For routine "sign me out everywhere" UX, prefer the self-service DELETE /api/self/sessions/{id} flow.
See also
- Self › Get Self Sessions — user-facing equivalent.
- Authentication — how sessions are created in the first place.