UserSession
An open —or already closed— session of the account. It is created at sign-in, on passing the second factor, or on a password change, and each one records where it was opened from and how long it is good for.
Properties
| Field | Type | Description |
|---|---|---|
id* | string (uuid) | Unique session identifier (UUID v7 time-ordered). This is the value the user references in `DELETE /v1/users/me/sessions/{id}`. |
is_current* | boolean | `true` when this session matches the current request (the cookie JWT's `jti` matches). Lets the UI mark "this session" without an extra round-trip. |
ip* | string | null | IP address where the session was minted. `null` when `REMOTE_ADDR` was unavailable at login (misconfigured proxy, headless test, etc.). |
user_agent* | string | null | `User-Agent` header captured when the session was minted. `null` when the client did not send the header. The UI parses it into a readable "browser · OS" label. |
created_at* | string (date-time) | UTC timestamp of session creation (ISO 8601). Equals the moment of the login / 2FA verify / password-change re-issue that minted it. |
last_used_at* | string (date-time) | UTC timestamp of the most recent authenticated request that used this session It is updated on every request, best-effort, and is what sorts the list by recency of use. |
expires_at* | string (date-time) | When the session expires on its own. Four hours from when it was opened, or twenty-four if sign-in asked to remember the device. After that instant it is rejects the JWT with `session_expired` even if the signature is still valid. |
Used in operations
GET /v1/users/me/sessions