> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nullpass.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Sessions

> View and manage user sessions

## Endpoints

```
GET /api/auth/sessions
DELETE /api/auth/sessions
```

## GET /api/auth/sessions

Retrieves all active sessions for the authenticated user. IP addresses are decrypted before returning.

### Response

<ResponseField name="sessions" type="array">
  Array of active session objects

  <Expandable title="Session Object">
    <ResponseField name="id" type="string">
      Session ID
    </ResponseField>

    <ResponseField name="ip" type="string">
      IP address (decrypted)
    </ResponseField>

    <ResponseField name="createdAt" type="string">
      Session creation timestamp
    </ResponseField>

    <ResponseField name="expiresAt" type="string">
      Session expiration timestamp
    </ResponseField>
  </Expandable>
</ResponseField>

## DELETE /api/auth/sessions

Deletes one or all sessions for the authenticated user.

### Query Parameters

<ParamField query="id" type="string">
  Optional. Session ID to delete. If omitted, deletes all sessions.
</ParamField>

### Response

<ResponseField name="success" type="boolean">
  Always `true` on success
</ResponseField>

## Implementation Details

### Code Reference

```11:86:nullpass_clean/src/app/api/auth/sessions/route.ts theme={null}
export async function GET(request: NextRequest) {
  const corsResponse = handleCors(request)
  if (corsResponse) return corsResponse

  const blocked = await protectRoute(request)
  if (blocked) return blocked

  const auth = await requireAuth(request)
  if ('error' in auth) return auth.error

  try {
    const sessions = await prisma.session.findMany({
      where: {
        userId: auth.userId,
        expiresAt: { gt: new Date() },
      },
      orderBy: { createdAt: 'desc' },
      select: {
        id: true,
        ip: true,
        createdAt: true,
        expiresAt: true,
      },
    })

    const sessionsWithDecryptedIp = sessions.map(session => ({
      ...session,
      ip: decryptIp(session.ip, auth.userId),
    }))

    return jsonResponse({ sessions: sessionsWithDecryptedIp }, 200, request.headers.get('origin'))
  } catch (error) {
    logger.error('Get sessions error:', error)
    return errorResponse('Internal server error', 500, request.headers.get('origin'))
  }
}

export async function DELETE(request: NextRequest) {
  const corsResponse = handleCors(request)
  if (corsResponse) return corsResponse

  const blocked = await protectRoute(request)
  if (blocked) return blocked

  const auth = await requireAuth(request)
  if ('error' in auth) return auth.error

  try {
    const { searchParams } = new URL(request.url)
    const sessionId = searchParams.get('id')

    if (sessionId) {
      await prisma.session.deleteMany({
        where: {
          id: sessionId,
          userId: auth.userId,
        },
      })
      await createAuditLog(auth.userId, 'SESSION_DELETE', {
        sessionId,
      })
    } else {
      await prisma.session.deleteMany({
        where: { userId: auth.userId },
      })
      await createAuditLog(auth.userId, 'USER_LOGOUT', {
        allSessions: true,
      })
    }

    return jsonResponse({ success: true }, 200, request.headers.get('origin'))
  } catch (error) {
    logger.error('Delete session error:', error)
    return errorResponse('Internal server error', 500, request.headers.get('origin'))
  }
}
```

## Status Codes

<ResponseField name="200" type="OK">
  Success
</ResponseField>

<ResponseField name="401" type="Unauthorized">
  Missing or invalid authentication token
</ResponseField>

## Example Requests

### Get All Sessions

```bash theme={null}
curl -X GET https://auth.nullpass.xyz/api/auth/sessions \
  -H "Authorization: Bearer YOUR_TOKEN"
```

### Delete Specific Session

```bash theme={null}
curl -X DELETE "https://auth.nullpass.xyz/api/auth/sessions?id=session_id_here" \
  -H "Authorization: Bearer YOUR_TOKEN"
```

### Delete All Sessions

```bash theme={null}
curl -X DELETE https://auth.nullpass.xyz/api/auth/sessions \
  -H "Authorization: Bearer YOUR_TOKEN"
```

## Example Response (GET)

```json theme={null}
{
  "sessions": [
    {
      "id": "clx1234567890",
      "ip": "192.168.1.1",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "expiresAt": "2024-01-08T00:00:00.000Z"
    },
    {
      "id": "clx0987654321",
      "ip": "10.0.0.1",
      "createdAt": "2024-01-02T00:00:00.000Z",
      "expiresAt": "2024-01-09T00:00:00.000Z"
    }
  ]
}
```

## Security Notes

* Only active (non-expired) sessions are returned
* IP addresses are encrypted in database but decrypted for display
* Users can only view/delete their own sessions
* Deleting all sessions effectively logs out the user from all devices

## Audit Events

* **SESSION\_DELETE**: Single session deleted (includes sessionId)
* **USER\_LOGOUT**: All sessions deleted (includes `allSessions: true`)


## OpenAPI

````yaml GET /auth/sessions
openapi: 3.1.0
info:
  title: Null Pass API
  description: >-
    Internal API documentation for Null Pass authentication and service
    management system
  version: 1.0.0
servers:
  - url: https://auth.nullpass.xyz/api
security: []
paths:
  /auth/sessions:
    get:
      tags:
        - Authentication
      summary: List Sessions
      description: Get all active sessions for the authenticated user
      responses:
        '200':
          description: List of sessions
          content:
            application/json:
              schema:
                type: object
                properties:
                  sessions:
                    type: array
                    items:
                      $ref: '#/components/schemas/Session'
      security:
        - bearerAuth: []
components:
  schemas:
    Session:
      type: object
      properties:
        id:
          type: string
        ip:
          type: string
        userAgent:
          type: string
          nullable: true
        createdAt:
          type: string
          format: date-time
        expiresAt:
          type: string
          format: date-time
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

````