v1

latestOpenAPI 3.0.3Apache 2.02026-07-1756158355.3 KB

frontend

Check Who the Current HTTP Session Belongs To

Uses the HTTP Headers in the GET request to determine (e.g. by using checking the cookies) who is authenticated. Returns a session object in the body or 401 if the credentials are invalid or no credentials were sent. When the request it successful it adds the user ID to the 'X-Kratos-Authenticated-Identity-Id' header in the response.

If you call this endpoint from a server-side application, you must forward the HTTP Cookie Header to this endpoint:

pseudo-code example
router.get('/protected-endpoint', async function (req, res) {
const session = await client.toSession(undefined, req.header('cookie'))

console.log(session)
})

When calling this endpoint from a non-browser application (e.g. mobile app) you must include the session token:

pseudo-code example
...
const session = await client.toSession("the-session-token")

console.log(session)

When using a token template, the token is included in the tokenized field of the session.

pseudo-code example
...
const session = await client.toSession("the-session-token", { tokenize_as: "example-jwt-template" })

console.log(session.tokenized) // The JWT

Depending on your configuration this endpoint might return a 403 status code if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

This endpoint is useful for:

AJAX calls. Remember to send credentials and set up CORS correctly! Reverse proxies and API Gateways Server-side calls - use the X-Session-Token header!

This endpoint authenticates users by checking:

if the Cookie HTTP header was set containing an Ory Kratos Session Cookie; if the Authorization: bearer <ory-session-token> HTTP header was set with a valid Ory Kratos Session Token; if the X-Session-Token HTTP header was set with a valid Ory Kratos Session Token.

If none of these headers are set or the cookie or token are invalid, the endpoint returns a HTTP 401 status code.

As explained above, this request may fail due to several reasons. The error.id can be one of:

session_inactive: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token). session_aal2_required: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.

get/sessions/whoami

Query parameters

tokenize_asstring

Returns the session additionally as a token (such as a JWT)

The value of this parameter has to be a valid, configured Ory Session token template. For more information head over to the documentation.

Headers

X-Session-Tokenstring

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookiestring

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Response

session

activeboolean

Active state. If false the session is no longer active.

authenticated_atstring date-time

The Session Authentication Timestamp

When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code challenge was completed).

authenticator_assurance_level'aal0' | 'aal1' | 'aal2' | 'aal3'

The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account.

Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g. password + TOTP) have been used.

To learn more about these levels please head over to: https://www.ory.sh/kratos/docs/concepts/credentials

expires_atstring date-time

The Session Expiry

When this session expires at.

idstring uuid required

Session ID

issued_atstring date-time

The Session Issuance Timestamp

When this session was issued at. Usually equal or close to authenticated_at.

tokenizedstring

Tokenized is the tokenized (e.g. JWT) version of the session.

It is only set when the tokenize_as query parameter was set to a valid tokenize template during calls to /session/whoami.

Example response

{
  "tokenized": "tokenized",
  "expires_at": "2000-01-23T04:56:07.000+00:00",
  "devices": [
    {
      "location": "location",
      "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
      "ip_address": "ip_address",
      "user_agent": "user_agent"
    },
    {
      "location": "location",
      "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
      "ip_address": "ip_address",
      "user_agent": "user_agent"
    }
  ],
  "authentication_methods": [
    {
      "completed_at": "2000-01-23T04:56:07.000+00:00",
      "method": "password",
      "provider": "provider",
      "organization": "organization",
      "aal": "aal0"
    },
    {
      "completed_at": "2000-01-23T04:56:07.000+00:00",
      "method": "password",
      "provider": "provider",
      "organization": "organization",
      "aal": "aal0"
    }
  ],
  "authenticator_assurance_level": null,
  "identity": {
    "traits": "",
    "credentials": {
      "key": {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "identifiers": [
          "identifiers",
          "identifiers"
        ],
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "type": "password",
        "config": "{}",
        "version": 0
      }
    },
    "state_changed_at": "2000-01-23T04:56:07.000+00:00",
    "created_at": "2000-01-23T04:56:07.000+00:00",
    "external_id": "external_id",
    "recovery_addresses": [
      {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "via": "via"
      },
      {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "via": "via"
      }
    ],
    "metadata_admin": "",
    "updated_at": "2000-01-23T04:56:07.000+00:00",
    "verifiable_addresses": [
      {
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified_at": "2000-01-23T04:56:07.000+00:00",
        "verified": true,
        "created_at": "2014-01-01T23:28:56.782Z",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "status": "status",
        "via": "email"
      },
      {
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified_at": "2000-01-23T04:56:07.000+00:00",
        "verified": true,
        "created_at": "2014-01-01T23:28:56.782Z",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "status": "status",
        "via": "email"
      }
    ],
    "organization_id": "organization_id",
    "schema_id": "schema_id",
    "schema_url": "schema_url",
    "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
    "state": "active",
    "metadata_public": ""
  },
  "authenticated_at": "2000-01-23T04:56:07.000+00:00",
  "active": true,
  "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
  "issued_at": "2000-01-23T04:56:07.000+00:00"
}