> ## Documentation Index
> Fetch the complete documentation index at: https://codebyahmed.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# List and Revoke Your Account Sessions — Sessions API
> List all active sessions for your account, revoke a specific session by its public ID, or sign out from every other device at once.
Session management gives you full visibility and control over every active login on your account. You can list all sessions ordered newest first, revoke a specific session by its public ID, or sign out from every device except the one you are currently using. All three operations require an active session cookie, and state-changing requests additionally require an `x-csrf-token` header.
## List Active Sessions
Retrieve all active sessions for your account, ordered newest first. Each session entry includes its public ID and timestamps you can display in a "Devices" or "Active Sessions" UI.
### Endpoint
```http theme={null}
GET https://api.example.com/api/v1/auth/sessions
```
### Example Request
```bash cURL theme={null}
curl -X GET https://api.example.com/api/v1/auth/sessions \
-b cookies.txt
```
```js JavaScript (fetch) theme={null}
const response = await fetch(
"https://api.example.com/api/v1/auth/sessions",
{ credentials: "include" }
);
const { data } = await response.json();
// data is an array of session objects
```
```python Python (requests) theme={null}
resp = session.get("https://api.example.com/api/v1/auth/sessions")
sessions = resp.json()["data"]
```
### Success Response — `200 OK`
```json theme={null}
{
"success": true,
"data": [
{
"public_id": "ses_01H",
"created_at": "2024-06-15T10:23:00Z",
"expires_at": "2024-07-15T10:23:00Z"
},
{
"public_id": "ses_02H",
"created_at": "2024-06-10T08:00:00Z",
"expires_at": "2024-07-10T08:00:00Z"
}
]
}
```
Unique public identifier for the session, prefixed `ses_`. Use this to revoke a specific session.
Timestamp when the session was created (i.e., when the user logged in).
Timestamp when the session will automatically expire.
***
## Revoke a Specific Session
Revoke any single session by its public ID. If the revoked session happens to be the one making the request, the server also clears the session cookie in the response.
### Endpoint
```http theme={null}
DELETE https://api.example.com/api/v1/auth/sessions/{session_public_id}
```
### Path Parameter
The `public_id` of the session to revoke, e.g. `ses_01H`. Obtain this from the `GET /auth/sessions` response.
### Example Request
```bash cURL theme={null}
# Step 1 — get CSRF token
CSRF=$(curl -s -b cookies.txt \
https://api.example.com/api/v1/auth/csrf-token \
| python3 -c "import sys,json; print(json.load(sys.stdin)['data']['csrf_token'])")
# Step 2 — revoke session ses_02H
curl -i -X DELETE https://api.example.com/api/v1/auth/sessions/ses_02H \
-b cookies.txt \
-H "x-csrf-token: $CSRF"
```
```js JavaScript (fetch) theme={null}
const csrfRes = await fetch(
"https://api.example.com/api/v1/auth/csrf-token",
{ credentials: "include" }
);
const { data: { csrf_token } } = await csrfRes.json();
await fetch(
"https://api.example.com/api/v1/auth/sessions/ses_02H",
{
method: "DELETE",
credentials: "include",
headers: { "x-csrf-token": csrf_token },
}
);
```
```python Python (requests) theme={null}
csrf_token = session.get(
"https://api.example.com/api/v1/auth/csrf-token"
).json()["data"]["csrf_token"]
resp = session.delete(
"https://api.example.com/api/v1/auth/sessions/ses_02H",
headers={"x-csrf-token": csrf_token},
)
# 204 No Content
```
### Success Response — `204 No Content`
The session is revoked. No response body is returned.
### Error Responses
| Status | Meaning | When it occurs |
| ------------------ | ----------------- | -------------------------------------------------------------------------- |
| `401 Unauthorized` | Not authenticated | No valid session cookie was sent. |
| `404 Not Found` | Session not found | The `session_public_id` does not exist or does not belong to your account. |
***
## Revoke All Other Sessions
Sign out from every active session **except** the current one. This is the "sign out from all other devices" action.
### Endpoint
```http theme={null}
DELETE https://api.example.com/api/v1/auth/sessions
```
### Example Request
```bash cURL theme={null}
CSRF=$(curl -s -b cookies.txt \
https://api.example.com/api/v1/auth/csrf-token \
| python3 -c "import sys,json; print(json.load(sys.stdin)['data']['csrf_token'])")
curl -i -X DELETE https://api.example.com/api/v1/auth/sessions \
-b cookies.txt \
-H "x-csrf-token: $CSRF"
```
```js JavaScript (fetch) theme={null}
const csrfRes = await fetch(
"https://api.example.com/api/v1/auth/csrf-token",
{ credentials: "include" }
);
const { data: { csrf_token } } = await csrfRes.json();
const response = await fetch(
"https://api.example.com/api/v1/auth/sessions",
{
method: "DELETE",
credentials: "include",
headers: { "x-csrf-token": csrf_token },
}
);
const data = await response.json();
```
```python Python (requests) theme={null}
csrf_token = session.get(
"https://api.example.com/api/v1/auth/csrf-token"
).json()["data"]["csrf_token"]
resp = session.delete(
"https://api.example.com/api/v1/auth/sessions",
headers={"x-csrf-token": csrf_token},
)
print(resp.json())
```
### Success Response — `200 OK`
```json theme={null}
{
"success": true
}
```
Your current session remains active. All other sessions for your account are revoked and those devices will be required to log in again.
### Error Responses
| Status | Meaning | When it occurs |
| ------------------ | ----------------- | --------------------------------- |
| `401 Unauthorized` | Not authenticated | No valid session cookie was sent. |
Use **Revoke All Other Sessions** after a password change or any time you suspect your account may have been accessed from an unknown device. Your current session stays active, so you remain logged in while every other browser and app is signed out immediately.
## Related Endpoints
Revoke only the current session and clear your cookie.
Reset your password — this also revokes all sessions automatically.