# List sessions

`GET /fapi/v1/me/sessions` · called from the environment's sign-in host

Returns the authenticated user's active sessions, most recently seen first. The session making the request has `current: true`. Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`. A first-party app on another origin can instead send its front API access token (`Authorization: DPoP <token>` with a DPoP proof; see [Front API access token](/docs/api/fapi/front-api-token)). No recent re-verification is needed.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |

No body.

## Response

`200 OK`:

| Field | Type | Description |
| --- | --- | --- |
| `data[].id` | string | Session identifier (`ses_…`). |
| `data[].current` | boolean | Whether this is the session making the request. |
| `data[].login_host` | string | Sign-in host the session was opened on. |
| `data[].browser_family` | string | Browser family, when known. |
| `data[].os_family` | string | Operating system family, when known. |
| `data[].device_type` | string | Device type, when known. |
| `data[].country` | string | Country the session was opened from (ISO 3166-1 alpha-2), when known. |
| `data[].ip_address` | string | Last seen IP address, else the one the session was opened from; absent once retention has cleared it. Shown only to the user themselves. |
| `data[].created_at` | string | When the session was opened (RFC 3339, UTC). |
| `data[].last_seen_at` | string | When the session was last used (RFC 3339, UTC). |

```json
{
  "data": [
    {
      "id": "ses_01jbz6x8kq3m2n4p5r6s7t8v9w",
      "current": true,
      "login_host": "example.keenauth.app",
      "browser_family": "firefox",
      "os_family": "linux",
      "device_type": "desktop",
      "country": "DE",
      "ip_address": "192.0.2.10",
      "created_at": "2026-10-01T09:30:00Z",
      "last_seen_at": "2026-10-12T08:15:00Z"
    }
  ]
}
```

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |

## Example

```bash
curl https://example.keenauth.app/fapi/v1/me/sessions \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -b cookies.txt
```

## Personal data

This endpoint carries personal data: sessions. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.