Docs/Account/API/Sessions

Sessions API

Manage user sessions — list active sessions, revoke individual sessions, or revoke all sessions for a user. Admin endpoints allow listing all sessions across the tenant.

Base URL: https://id.vyntech.com.au/api/v1 — All endpoints require authentication. Sessions are scoped to the tenant from the JWT.

Returns all active sessions for the currently authenticated user. Includes device info, IP address, and last activity time. Useful for "active sessions" UI.

My SessionsAuth

List the current user's active sessions.

Status Codes

Name
200
Type
HTTP
Description
Sessions list returned
Name
401
Type
HTTP
Description
Invalid or expired access token

Request

GET/api/v1/sessions

Response 200

Revokes a specific session by ID. The session's refresh token is invalidated immediately. Users can revoke their own sessions; admins with sessions:write can revoke any session in the tenant.

24-Hour Cooldown: For security, users cannot revoke other sessions within 24 hours of their current session being created. This prevents an attacker who gains temporary access from immediately locking out the legitimate user. The API returns 403 with COOLDOWN_ACTIVE code and a remaining_ms field indicating time left. Admin overrides are not subject to this restriction.

SessionAuth

Revoke a specific session.

Status Codes

Name
200
Type
HTTP
Description
Session revoked
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Cooldown active (within 24h of login) or insufficient permissions
Name
404
Type
HTTP
Description
Session not found

Request

DELETE/api/v1/sessions/:id

Response 200

Revokes all sessions for the current user except the current session (optional). Useful for "sign out everywhere" functionality.

24-Hour Cooldown: Subject to the same cooldown as individual revocation. If the current session was created less than 24 hours ago, this endpoint returns 403 with {"code": "COOLDOWN_ACTIVE", "remaining_ms": 43200000}. The Account UI displays a countdown timer during this period.

All SessionsAuth

Revoke all sessions for the current user.

Payload Example

{
  "exclude_current": true
}

Status Codes

Name
200
Type
HTTP
Description
Sessions revoked
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Cooldown active — session created less than 24 hours ago

Request

POST/api/v1/sessions/revoke-all

Response 200

Returns a paginated list of all active sessions across the entire tenant. Requires sessions:read permission. Useful for security dashboards and monitoring.

All Sessions (Admin)Auth

List all sessions in the tenant (admin only).

Status Codes

Name
200
Type
HTTP
Description
Sessions list returned
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Missing sessions:read permission

Request

GET/api/v1/admin/sessions

Response 200

What's Next

Roles & Permissions API →

Create and manage roles, permissions, and authorization checks.

Session Management Guide →

Configure session lifetimes, concurrent limits, and forced logout.

Users API →

Manage users, assign roles, and update profiles.

Authentication API →