Sessions

Sessions

Every browser login writes a row to the auth_sessions table (with started_at, last_seen_at, IP address, and user agent), so each user can see and revoke the devices signed in to their account. The API is api/routes/auth_sessions.py, served from the isolated auth database pool.

List your sessions

GET /v1/auth/sessions  →
{
  "sessions": [
    { "id": 1, "ip_address": "...", "user_agent": "...",
      "started_at": "...", "last_seen_at": "...",
      "ended_at": null, "ended_reason": null,
      "active": true, "is_current": true }
  ]
}

The response returns up to 50 sessions, newest first, and flags the one you are calling from with is_current.

Revoke sessions

DELETE /v1/auth/sessions/{session_id}   — end one session
DELETE /v1/auth/sessions                — end every session (all devices)

Revoking a session marks it ended with a reason (explicit_stop if it's your current device, admin_revoked otherwise). Revoking your current session also clears your API key hash and evicts the 60-second session cache, so the next request from that device gets a 401 immediately rather than waiting for the cache to expire. Revoking all sessions clears the key hash outright — every device must sign in again. Both operations write an audit event: auth.session.revoked for a single revocation and auth.session.revoked_all for the revoke-all path.

Idle and absolute timeouts

Beyond manual revocation, sessions expire on a schedule you configure per tenant (see Security settings). Enforcement lives in core/auth/session_expiry.py and runs at the single chokepoint where every request resolves its bearer token, so expiry is evaluated at most once per 60 seconds per token.

• Idle timeout (session_idle_timeout_minutes) — logs out an inactive session. Each still-valid request bumps last_seen_at, so the idle clock measures inactivity, not time since login.
• Absolute timeout (session_absolute_timeout_hours) — caps total session lifetime regardless of activity.

A value of 0 (or unset) disables that dimension. Per-role overrides are available — see the note below.