Manage Sessions

GET

auth

sessions

List Sessions

curl --request GET \
  --url https://auth.nullpass.xyz/api/auth/sessions \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://auth.nullpass.xyz/api/auth/sessions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://auth.nullpass.xyz/api/auth/sessions",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.nullpass.xyz/api/auth/sessions"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://auth.nullpass.xyz/api/auth/sessions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "sessions": [
    {
      "id": "<string>",
      "ip": "<string>",
      "userAgent": "<string>",
      "createdAt": "2023-11-07T05:31:56Z",
      "expiresAt": "2023-11-07T05:31:56Z"
    }
  ]
}

Endpoints

GET /api/auth/sessions
DELETE /api/auth/sessions

GET /api/auth/sessions

Retrieves all active sessions for the authenticated user. IP addresses are decrypted before returning.

Response

array

Array of active session objects

Show Session Object

string

Session ID

string

IP address (decrypted)

string

Session creation timestamp

string

Session expiration timestamp

DELETE /api/auth/sessions

Deletes one or all sessions for the authenticated user.

Query Parameters

string

Optional. Session ID to delete. If omitted, deletes all sessions.

Response

boolean

Always true on success

Implementation Details

Code Reference

export async function GET(request: NextRequest) {
  const corsResponse = handleCors(request)
  if (corsResponse) return corsResponse

  const blocked = await protectRoute(request)
  if (blocked) return blocked

  const auth = await requireAuth(request)
  if ('error' in auth) return auth.error

  try {
    const sessions = await prisma.session.findMany({
      where: {
        userId: auth.userId,
        expiresAt: { gt: new Date() },
      },
      orderBy: { createdAt: 'desc' },
      select: {
        id: true,
        ip: true,
        createdAt: true,
        expiresAt: true,
      },
    })

    const sessionsWithDecryptedIp = sessions.map(session => ({
      ...session,
      ip: decryptIp(session.ip, auth.userId),
    }))

    return jsonResponse({ sessions: sessionsWithDecryptedIp }, 200, request.headers.get('origin'))
  } catch (error) {
    logger.error('Get sessions error:', error)
    return errorResponse('Internal server error', 500, request.headers.get('origin'))
  }
}

export async function DELETE(request: NextRequest) {
  const corsResponse = handleCors(request)
  if (corsResponse) return corsResponse

  const blocked = await protectRoute(request)
  if (blocked) return blocked

  const auth = await requireAuth(request)
  if ('error' in auth) return auth.error

  try {
    const { searchParams } = new URL(request.url)
    const sessionId = searchParams.get('id')

    if (sessionId) {
      await prisma.session.deleteMany({
        where: {
          id: sessionId,
          userId: auth.userId,
        },
      })
      await createAuditLog(auth.userId, 'SESSION_DELETE', {
        sessionId,
      })
    } else {
      await prisma.session.deleteMany({
        where: { userId: auth.userId },
      })
      await createAuditLog(auth.userId, 'USER_LOGOUT', {
        allSessions: true,
      })
    }

    return jsonResponse({ success: true }, 200, request.headers.get('origin'))
  } catch (error) {
    logger.error('Delete session error:', error)
    return errorResponse('Internal server error', 500, request.headers.get('origin'))
  }
}

Status Codes

Success

Unauthorized

Missing or invalid authentication token

Example Requests

Get All Sessions

curl -X GET https://auth.nullpass.xyz/api/auth/sessions \
  -H "Authorization: Bearer YOUR_TOKEN"

Delete Specific Session

curl -X DELETE "https://auth.nullpass.xyz/api/auth/sessions?id=session_id_here" \
  -H "Authorization: Bearer YOUR_TOKEN"

Delete All Sessions

curl -X DELETE https://auth.nullpass.xyz/api/auth/sessions \
  -H "Authorization: Bearer YOUR_TOKEN"

Example Response (GET)

{
  "sessions": [
    {
      "id": "clx1234567890",
      "ip": "192.168.1.1",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "expiresAt": "2024-01-08T00:00:00.000Z"
    },
    {
      "id": "clx0987654321",
      "ip": "10.0.0.1",
      "createdAt": "2024-01-02T00:00:00.000Z",
      "expiresAt": "2024-01-09T00:00:00.000Z"
    }
  ]
}

Security Notes

Only active (non-expired) sessions are returned
IP addresses are encrypted in database but decrypted for display
Users can only view/delete their own sessions
Deleting all sessions effectively logs out the user from all devices

Audit Events

SESSION_DELETE: Single session deleted (includes sessionId)
USER_LOGOUT: All sessions deleted (includes allSessions: true)

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Response

200 - application/json

List of sessions

sessions

object[]

Show child attributes

List Sessions

curl --request GET \
  --url https://auth.nullpass.xyz/api/auth/sessions \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://auth.nullpass.xyz/api/auth/sessions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://auth.nullpass.xyz/api/auth/sessions",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.nullpass.xyz/api/auth/sessions"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://auth.nullpass.xyz/api/auth/sessions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "sessions": [
    {
      "id": "<string>",
      "ip": "<string>",
      "userAgent": "<string>",
      "createdAt": "2023-11-07T05:31:56Z",
      "expiresAt": "2023-11-07T05:31:56Z"
    }
  ]
}

Get Started

Authentication

Services

Webhooks

Account Management

Service Connection

Polar Integration

Admin

Advanced

Library

Endpoints

GET /api/auth/sessions

Response

DELETE /api/auth/sessions

Query Parameters

Response

Implementation Details

Code Reference

Status Codes

Example Requests

Get All Sessions

Delete Specific Session

Delete All Sessions

Example Response (GET)

Security Notes

Audit Events

Authorizations

Response

​Endpoints

​GET /api/auth/sessions

​Response

​DELETE /api/auth/sessions

​Query Parameters

​Response

​Implementation Details

​Code Reference

​Status Codes

​Example Requests

​Get All Sessions

​Delete Specific Session

​Delete All Sessions

​Example Response (GET)

​Security Notes

​Audit Events

Authorizations

Response

Endpoints

GET /api/auth/sessions

Response

DELETE /api/auth/sessions

Query Parameters

Response

Implementation Details

Code Reference

Status Codes

Example Requests

Get All Sessions

Delete Specific Session

Delete All Sessions

Example Response (GET)

Security Notes

Audit Events