# Get a session

`GET /v1/sessions/{session_id}` · permission `sessions:read`

Returns one session in any status (`active`, `expired`, `revoked`). The full IP address is shown and the view is written to the management audit log. Cookies, tokens and device fingerprints are never returned.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `session_id` | path | yes | Session id, prefixed `ses_`. |

## Response

`200 OK`. Empty fields are `null`.

```json
{
  "id": "ses_0a1b2c3d4e5f6g7h8j9k0m1n2p",
  "user_id": "usr_0a1b2c3d4e5f6g7h8j9k0m1n2p",
  "status": "revoked",
  "login_host": "login.example.com",
  "auth_time": "2026-02-01T08:00:00Z",
  "acr": "1fa",
  "amr": ["pwd"],
  "created_at": "2026-02-01T08:00:00Z",
  "last_seen_at": "2026-02-01T09:15:00Z",
  "idle_expires_at": "2026-02-08T09:15:00Z",
  "absolute_expires_at": "2026-03-03T08:00:00Z",
  "org_id": "org_0a1b2c3d4e5f6g7h8j9k0m1n2p",
  "ip_address": "203.0.113.10",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)",
  "revoked_at": "2026-02-01T10:00:00Z",
  "revoke_reason": "admin"
}
```

`revoke_reason` is set only for `revoked` sessions, for example `admin`, `user_logout`, `idp_logout` or `refresh_reuse`.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 404 | `not_found` | The session does not exist in this environment (or the id is malformed). |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `sessions:read` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl https://api.eu.keenauth.com/v1/sessions/ses_0a1b2c3d4e5f6g7h8j9k0m1n2p \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth sessions get ses_0a1b2c3d4e5f6g7h8j9k0m1n2p`

## Personal data

This endpoint carries personal data: sessions. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.