> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Sessions and Tokens

Inspect and revoke auth sessions, and mint or refresh access tokens.

## Get the current session

`GET /iam/v2/auth/get-session`

### Query parameters

- `disableCookieCache` `boolean`: Disable cookie cache and fetch session from database

### Responses

#### `200`: Success

Body (`application/json`):

- `session` `object` _(required)_
  - `id` `string` _(required)_
  - `expiresAt` `string` _(required)_
  - `token` `string` _(required)_
  - `createdAt` `string` _(required)_
  - `updatedAt` `string` _(required)_
  - `ipAddress` `string`
  - `userAgent` `string`
  - `userId` `string` _(required)_
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `name` `string` _(required)_
  - `email` `string` _(required)_
  - `emailVerified` `boolean`
  - `image` `string`
  - `createdAt` `string` _(required)_
  - `updatedAt` `string` _(required)_
  - `isAnonymous` `boolean`
  - `phoneNumber` `string`
  - `phoneNumberVerified` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl 'https://api.openfort.io/iam/v2/auth/get-session?disableCookieCache=false'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/get-session?disableCookieCache=false')
```

## List sessions

`GET /iam/v2/auth/list-sessions`

List all active sessions for the user

### Responses

#### `200`: Success

Body (`application/json`):

- `id` `string` _(required)_
- `expiresAt` `string` _(required)_
- `token` `string` _(required)_
- `createdAt` `string` _(required)_
- `updatedAt` `string` _(required)_
- `ipAddress` `string`
- `userAgent` `string`
- `userId` `string` _(required)_

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/list-sessions
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/list-sessions')
```

## Revoke session

`POST /iam/v2/auth/revoke-session`

Revoke a single session

### Request body (`application/json`)

- `token` `string` _(required)_: The token to revoke

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if the session was revoked successfully

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/revoke-session \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "token": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/revoke-session', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    token: 'string'
  })
})
```

## Revoke sessions

`POST /iam/v2/auth/revoke-sessions`

Revoke all sessions for the user

### Request body (`application/json`)

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if all sessions were revoked successfully

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/revoke-sessions \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/revoke-sessions', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
})
```

## Revoke other sessions

`POST /iam/v2/auth/revoke-other-sessions`

Revoke all other sessions for the user except the current one

### Request body (`application/json`)

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if all other sessions were revoked successfully

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/revoke-other-sessions \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/revoke-other-sessions', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
})
```

## Refresh access token

`POST /iam/v2/auth/refresh-token`

Refresh the access token using a refresh token

### Request body (required) (`application/json`)

- `providerId` `string` _(required)_: The provider ID for the OAuth provider
- `accountId` `string | null`: The account ID associated with the refresh token
- `userId` `string | null`: The user ID associated with the account

### Responses

#### `200`: Access token refreshed successfully

Body (`application/json`):

- `tokenType` `string`
- `idToken` `string`
- `accessToken` `string`
- `refreshToken` `string`
- `accessTokenExpiresAt` `string <date-time>`
- `refreshTokenExpiresAt` `string <date-time>`

#### `400`: Invalid refresh token or provider configuration

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/refresh-token \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "providerId": "string",
  "accountId": "string",
  "userId": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/refresh-token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    providerId: 'string',
    accountId: 'string',
    userId: 'string'
  })
})
```

## Get access token

`POST /iam/v2/auth/get-access-token`

Get a valid access token, doing a refresh if needed

### Request body (required) (`application/json`)

- `providerId` `string` _(required)_: The provider ID for the OAuth provider
- `accountId` `string | null`: The account ID associated with the refresh token
- `userId` `string | null`: The user ID associated with the account

### Responses

#### `200`: A Valid access token

Body (`application/json`):

- `tokenType` `string`
- `idToken` `string`
- `accessToken` `string`
- `refreshToken` `string`
- `accessTokenExpiresAt` `string <date-time>`
- `refreshTokenExpiresAt` `string <date-time>`

#### `400`: Invalid refresh token or provider configuration

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/get-access-token \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "providerId": "string",
  "accountId": "string",
  "userId": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/get-access-token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    providerId: 'string',
    accountId: 'string',
    userId: 'string'
  })
})
```