Retrieve Active Login Sessions

This API retrieves all active login sessions associated with a given user (sub). This helps track active sessions and enhance security by monitoring token usage.

Use Case:

  1. View all active login sessions of a specific user.
  2. Identify suspicious activity by analyzing IP addresses and user agents.

Endpoint

POST /app/{app_id}/get-session

Headers

Name Type Required Description
Authorization string Yes The app-key of the project.

Example Request

curl --request POST \
  --url http://{{your-endpoint}}:{{your-port}}/app/{{app-id}}/get-session \
  --header 'Authorization: {{app-key}}' \
  --header 'content-type: application/json' \
  --data '{
  "sub":"test@test.com"
}'
const request = require('request');

const options = {
  method: 'POST',
  url: 'http://{{your-endpoint}}:{{your-port}}/app/{{app-id}}/get-session',
  headers: {Authorization: '{{app-key}}', 'content-type': 'application/json'},
  body: {sub: 'test@test.com'},
  json: true
};

request(options, function (error, response, body) {
  if (error) throw new Error(error);

  console.log(body);
});
import requests

url = "http://{{your-endpoint}}:{{your-port}}/app/{{app-id}}/get-session"

payload = { "sub": "test@test.com" }
headers = {
    "Authorization": "{{app-key}}",
    "content-type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
<?php
$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'http://{{your-endpoint}}:{{your-port}}/app/{{app-id}}/get-session', [
  'body' => '{
  "sub":"test@test.com"
}',
  'headers' => [
    'Authorization' => '{{app-key}}',
    'content-type' => 'application/json',
  ],
]);

echo $response->getBody();
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "http://{{your-endpoint}}:{{your-port}}/app/{{app-id}}/get-session"

  payload := strings.NewReader("{\n  \"sub\":\"test@test.com\"\n}")

  req, _ := http.NewRequest("POST", url, payload)

  req.Header.Add("Authorization", "{{app-key}}")
  req.Header.Add("content-type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}
AsyncHttpClient client = new DefaultAsyncHttpClient();
client.prepare("POST", "http://{{your-endpoint}}:{{your-port}}/app/{{app-id}}/get-session")
  .setHeader("Authorization", "{{app-key}}")
  .setHeader("content-type", "application/json")
  .setBody("{\n  \"sub\":\"test@test.com\"\n}")
  .execute()
  .toCompletableFuture()
  .thenAccept(System.out::println)
  .join();

client.close();

Request Fields

Field Type Required Description
sub string Yes The subject (user identifier) whose active sessions need to be retrieved.

Example Success Response

{
"sessions": [
  {
    "token_id": "01JMWQPW6DMW8MMV8MG1WNJXBK",
    "key_id": "01JMV28FJVBKF0JG0YSG655EHY",
    "auth_token_iat": 1740426145,
    "auth_token_nbf": 1740426145,
    "auth_token_exp": 1740429745,
    "refresh_token_iat": 1740426145,
    "refresh_token_nbf": 1740426205,
    "refresh_token_exp": 1740436945,
    "ip_address": "1.1.1.1",
    "user_agent": "test-agent"
  }
]
}

Response Fields

Field Type Description
sessions array List of sessions associated with the subject.
token_id string Unique ID of the authentication token.
key_id String Associated key id for the token.
auth_token_iat Int Issued at timestamp of the authentication token.
auth_token_nbf Int Not before timestamp of the authentication token.
auth_token_exp Int Expiry timestamp of the authentication token.
refresh_token_iat Int Issued at timestamp of the refresh token.
refresh_token_nbf Int Not before timestamp of the refresh token.
refresh_token_exp Int Expiry timestamp of the refresh token.
ip_address String IP address from which the session was initiated.
user_agent String User agent details of the session.

Additional Notes:

  1. The response will include all valid sessions associated with the given subject (sub).
  2. Expired sessions will not be included in the response.

Responses

Status Code Description
200 Ok Success
400 Bad Request Mostly when the form validation fails. The error will be returned as a response.
403 Access Denied When the provided app key in Authorization header is invalid.
500 Internal Server Error Mostly because of the database error. Check the log for root cause details.