# Your Sessions

Where the signed-in user is signed in: one entry per active session, the most recently active first. Every role may read its own.

## Overview

- A session starts at a sign-in ([Login](https://docs.aureahub.com/docs/auth-login.md), [Register](https://docs.aureahub.com/docs/auth-register.md), Google or Apple sign-in, the second step of a two-factor sign-in) and lives as long as its refresh token: each [refresh](https://docs.aureahub.com/docs/auth-refresh.md) renews it. It ends at [Log Out](https://docs.aureahub.com/docs/auth-logout.md), when it is ended with [End a Session](https://docs.aureahub.com/docs/auth-session-end.md) or [Sign Out Elsewhere](https://docs.aureahub.com/docs/auth-sessions-revoke-others.md), or when its refresh token expires.
- Each entry: `id` (the session to end), `current` (`true` for the session of the access token that made this request), `startedAt`, `lastActiveAt` (the last sign-in or refresh), `expiresAt` (when it ends unless it refreshes before), `device` and `ipAddress`.
- `device` is read from the `User-Agent` of the request that last renewed the session: `userAgent` as sent, `browser`, `os` and a `label` such as `"Safari on iPhone"`, each `null` when it cannot be told. `ipAddress` is that request's address; there is no location. Sessions started before 21 October 2026 have neither.
- At most 100 sessions are answered. There is no pagination.
- Sessions are kept where refresh tokens are rotated ([Refresh Token › Rotation](https://docs.aureahub.com/docs/auth-refresh.md)). Where they are not, the answer is `{ "tracked": false, "sessions": [] }`.
- The answer is sent with `Cache-Control: no-store`.

## Endpoint

### `GET /v1/auth/sessions`

Authentication: bearer token required.

The caller's active sessions, the most recently active first.

**Responses**

`200` OK

```json
{
  "tracked": true,
  "sessions": [
    {
      "id": "0b6f2d4e-8a1c-4e3f-9d27-5c4b3a2f1e0d",
      "current": true,
      "startedAt": "2026-10-21T08:02:11.000Z",
      "lastActiveAt": "2026-10-21T10:41:37.000Z",
      "expiresAt": "2026-10-28T10:41:37.000Z",
      "device": {
        "userAgent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Mobile/15E148 Safari/604.1",
        "browser": "Safari",
        "os": "iOS",
        "label": "Safari on iPhone"
      },
      "ipAddress": "203.0.113.24"
    },
    {
      "id": "7e3a9c51-2d4b-4f86-a0e1-6b5c4d3e2f1a",
      "current": false,
      "startedAt": "2026-10-14T16:20:05.000Z",
      "lastActiveAt": "2026-10-20T18:03:44.000Z",
      "expiresAt": "2026-10-27T18:03:44.000Z",
      "device": { "userAgent": null, "browser": null, "os": null, "label": null },
      "ipAddress": null
    }
  ]
}
```

`200` Not kept

```json
{
  "tracked": false,
  "sessions": []
}
```

**Example request**

```bash
curl https://api.aureahub.com/v1/auth/sessions \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#auth-sessions