---
title: "List user sessions"
method: GET
path: "/api/v1/users/{user_id}/sessions"
tags: ["Sessions"]
---

# List user sessions

`GET /api/v1/users/{user_id}/sessions`

Retrieves a paginated list of all sessions associated with a specific user across all devices and browsers. Use this endpoint to audit user activity, display all active sessions in account management interfaces, or verify user authentication status across devices. Supports filtering by session status (active, expired, revoked, logout) and time range (creation date). Returns session details for each session including device information, IP address, geolocation, and current status. The response includes pagination metadata (page tokens and total count) to handle large session lists efficiently.

## Path parameters

- `user_id` string, required

## Query parameters

- `page_size` integer
- `page_token` string
- `filter.status` string[]
- `filter.start_time` string, date-time
- `filter.end_time` string, date-time

## Response `200`

Successfully retrieved user sessions. Returns a list of sessions with pagination information

- SessionsUserSessionDetails
  - `next_page_token` string — Pagination token for retrieving the next page of results. Empty string if there are no more pages (you have reached the final page of results).
  - `prev_page_token` string — Pagination token for retrieving the previous page of results. Empty string for the first page. Use this to navigate backward through result pages.
  - `sessions` SessionsSessionDetails[] — Array of session objects for the requested user. May contain fewer entries than the requested page_size when reaching the final page of results.
    - `absolute_expires_at` string, date-time — Hard expiration timestamp for the session regardless of user activity. The session will be forcibly terminated at this time. This represents the maximum session lifetime from creation.
    - `authenticated_clients` SessionsAuthenticatedClients[] — Details of the authenticated clients for this session: client ID and organization context.
      - `client_id` string — Unique identifier of the authenticated client application.
      - `organization_id` string — Active or last active Organization ID associated with the authenticated client.
    - `authenticated_organizations` string[] — List of organization IDs that have been authenticated for this user within the current session. Contains all organizations where the user has successfully completed SSO or authentication.
    - `created_at` string, date-time — Timestamp indicating when the session was created. This is set once at session creation and remains constant throughout the session lifetime.
    - `device` SessionsDeviceDetails
      - `browser` string — Browser name and family extracted from the user agent. Examples: Chrome, Safari, Firefox, Edge, Mobile Safari.
      - `browser_version` string — Version of the browser application. Represents the specific release version of the browser being used.
      - `device_type` string — Categorized device type classification. Possible values: 'desktop' (traditional computers), 'mobile' (smartphones and small tablets), 'tablet' (large tablets), 'other'. Useful for displaying session information by device category.
      - `ip` string — IP address of the device that initiated the session. This is the public-facing IP address used to connect to the application. Useful for security audits and geographic distribution analysis.
      - `location` V1sessionsLocation
        - `city` string — City name where the session originated based on IP geolocation. Approximate location derived from IP address.
        - `latitude` string — Latitude coordinate of the estimated location. Decimal format (e.g., '37.7749'). Note: Represents IP geolocation center and may not be precise.
        - `longitude` string — Longitude coordinate of the estimated location. Decimal format (e.g., '-122.4194'). Note: Represents IP geolocation center and may not be precise.
        - `region` string — Geographic region name derived from IP geolocation. Represents the country-level location (e.g., 'United States', 'France').
        - `region_subdivision` string — Regional subdivision code or name (e.g., state abbreviation for US, province for Canada). Two-letter ISO format when applicable.
      - `os` string — Operating system name extracted from the user agent and device headers. Examples: macOS, Windows, Linux, iOS, Android.
      - `os_version` string — Version of the operating system. Represents the specific OS release the device is running.
      - `user_agent` string — Complete HTTP User-Agent header string from the client request. Contains browser type, version, and operating system information. Used for detailed device fingerprinting and user agent analysis.
    - `expired_at` string, date-time — Timestamp when the session was terminated. Null if the session is still active. Set when the session expires due to reaching idle_expires_at or absolute_expires_at timeout, or when administratively revoked. Not set for user-initiated logout (see logout_at instead).
    - `idle_expires_at` string, date-time — Projected expiration timestamp if the session remains idle without user activity. This timestamp is recalculated with each user activity. Session will be automatically terminated at this time if no activity occurs.
    - `last_active_at` string, date-time — Timestamp of the most recent user activity detected in this session. Updated on each API request or user interaction. Used to determine if a session has exceeded the idle timeout threshold.
    - `logout_at` string, date-time — Timestamp when the user explicitly logged out from the session. Null if the user has not logged out. When set, indicates the session ended due to explicit user logout rather than timeout.
    - `organization_id` string — Organization ID for the user's most recently active organization within this session. This represents the primary organization context for the current session.
    - `session_id` string — Unique identifier for the session. System-generated read-only field used to reference this session.
    - `status` string — Current operational status of the session. Possible values: 'active' (session is valid and requests are allowed), 'expired' (session terminated due to idle or absolute timeout), 'revoked' (session was administratively revoked), 'logout' (user explicitly logged out). Use this to determine if the session can be used for new requests.
    - `updated_at` string, date-time — Timestamp indicating when the session was last updated. Updated whenever session state changes such as organization context changes or metadata updates.
    - `user_id` string — Unique identifier for the user who owns and is authenticated within this session.
  - `total_size` integer — Total number of sessions matching the applied filter criteria, regardless of pagination. This represents the complete result set size before pagination is applied.

---

[API](https://skmtc.net/scalekit/apis/scalekit-api-reference.md) · [All operations](https://skmtc.net/scalekit/apis/scalekit-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scalekit/scalekit-api-reference/versions/a40d5d4650e5/schema)