List the caller's active sessions

GET/api/user/sessions

listMySessions

Session-authenticated caller only. Returns live sessions for the authenticated user with their `issued_ip`, `issued_user_agent`, `created_at`, and the throttled `last_seen_at` watermark. The session that issued the current request is marked `current: true`.

Requires authentication using a session cookie — see tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/user/sessions' \
  -b 'ns_session=$NEOSOURCE_SESSION'

fetch

fetch("https://neosource.dev/api/user/sessions", {
  method: "GET",
  credentials: "include",
});

Responses

200Session list

application/json

SessionListResponse

object

sessionsrequired

array

items

SessionSummary

object

One row in the "Active sessions" surface on `/settings/security`. `issued_ip` and `issued_user_agent` are the values recorded at session-creation time; the SPA displays the UA string raw — no parsing library is pulled in by design.

created_atrequired: integerint64
currentrequired: boolean
True for the session that issued the current request. The SPA uses this to disable the per-row "Revoke" button and surface the "current session" pill.
issued_ip: string | null
Source IP rendered as a string (`192.0.2.1` / `2001:db8::1`). `None` for sessions minted in a context without a transport (CLI-token exchange, tests, OAuth callback before slice-#6's proxy validation lands).
issued_user_agent: string | null
last_seen_at: integer | nullint64
Millis-since-epoch of the last throttled `last_seen_at` write (~once per minute per session per the extractor's cooldown). `None` until the first authenticated request lands on the session after its creation.
session_idrequired: string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget