Docs/Account/API/Sessions

Sessions API

Manage user sessions — list active sessions, revoke individual sessions, or revoke all sessions for a user. Admin endpoints allow listing all sessions across the tenant.

Base URL: https://id.vyntech.com.au/api/v1 — All endpoints require authentication. Sessions are scoped to the tenant from the JWT.

List My Sessions

Returns all active sessions for the currently authenticated user. Includes device info, IP address, and last activity time. Useful for "active sessions" UI.

GET/api/v1/sessions🔒 Auth

List the current user's active sessions.

curl https://id.vyntech.com.au/api/v1/sessions \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..."

Revoke Session

Revokes a specific session by ID. The session's refresh token is invalidated immediately. Users can revoke their own sessions; admins with sessions:write can revoke any session in the tenant.

24-Hour Cooldown: For security, users cannot revoke other sessions within 24 hours of their current session being created. This prevents an attacker who gains temporary access from immediately locking out the legitimate user. The API returns 403 with COOLDOWN_ACTIVE code and a remaining_ms field indicating time left. Admin overrides are not subject to this restriction.

DELETE/api/v1/sessions/:id🔒 Auth

Revoke a specific session.

curl -X DELETE https://id.vyntech.com.au/api/v1/sessions/ses_01H9QRST6U8V3W5Y7A9C1E3G \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..."

Revoke All Sessions

Revokes all sessions for the current user except the current session (optional). Useful for "sign out everywhere" functionality.

24-Hour Cooldown: Subject to the same cooldown as individual revocation. If the current session was created less than 24 hours ago, this endpoint returns 403 with {"code": "COOLDOWN_ACTIVE", "remaining_ms": 43200000}. The Account UI displays a countdown timer during this period.

POST/api/v1/sessions/revoke-all🔒 Auth

Revoke all sessions for the current user.

curl -X POST https://id.vyntech.com.au/api/v1/sessions/revoke-all \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..." \ -H "Content-Type: application/json" \ -d '{"exclude_current": true}'

Request Body

{
  "exclude_current": true
}

List All Sessions (Admin)

Returns a paginated list of all active sessions across the entire tenant. Requires sessions:read permission. Useful for security dashboards and monitoring.

GET/api/v1/admin/sessions🔒 Auth

List all sessions in the tenant (admin only).

curl "https://id.vyntech.com.au/api/v1/admin/sessions?page=1&per_page=50" \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..."

What's Next

Roles & Permissions API →

Create and manage roles, permissions, and authorization checks.

Session Management Guide →

Configure session lifetimes, concurrent limits, and forced logout.

Users API →

Manage users, assign roles, and update profiles.

Authentication API →