List Active Sessions
Lists the calling user's own active (non-expired) sessions, most-recently-active first. The session matching the credential on this request is flagged is_current. The session token (JWT) is never returned.
Auth model. Sessions are JWT + a global token_version; there is no per-request session lookup. A session row is therefore a record of a sign-in — deleting one (see Revoke Session) is record-only and that device's token keeps working until it expires. For an immediate, effective sign-out of other devices use Sign Out Other Sessions.
Response (200 OK)
A JSON array of session objects (not wrapped).
[].id int64
Session row ID — use in DELETE /v1/user/sessions/{id}.
[].user_id int64
ID of the user the session belongs to. This endpoint only returns the caller's own sessions, so it always equals the authenticated caller's user ID.
[].device string
Parsed device/browser (e.g.
Safari on iPhone).[].ip_address string
Real client IP captured at sign-in.
[].location string
ISO-3166 alpha-2 country code (e.g.
FI).[].location_detail string
"ISP · timezone". May be empty.[].user_agent string
Raw User-Agent string.
[].created_at, last_activity, expires_at datetime
RFC 3339 UTC timestamps.
[].is_current bool
true for the session presenting the credential on this request.Errors
401 Unauthorized
Missing or invalid auth.
Request
curl "https://api.ngris.com/v1/user/sessions" \
-H "X-API-KEY: <your_api_key>"
Response — 200 OK
[
{
"id": 5521,
"user_id": 1024,
"device": "Chrome on macOS",
"ip_address": "65.21.194.241",
"location": "FI",
"location_detail": "Hetzner Online GmbH · Europe/Helsinki",
"user_agent": "Mozilla/5.0 ...",
"created_at": "2026-05-20T10:00:00Z",
"last_activity": "2026-05-29T08:14:02Z",
"expires_at": "2026-06-19T10:00:00Z",
"is_current": true
}
]