Sessions

Endpoints for managing active user sessions across devices.

GET /api/sessions

List active sessions with optional filtering.

Authentication: Required

Query Parameters:

Parameter	Type	Description
`username`	string	Filter by username

List active sessionsGET /api/sessions

Each session embeds its user and carries the device/browser fingerprint. username filters the list.

Response · 200

{
  "_links": {
    "self": {
      "href": "https://informer.example.com/api/sessions"
    }
  },
  "start": 0,
  "count": 2,
  "total": 2,
  "_embedded": {
    "inf:session": [
      {
        "_links": {
          "self": {
            "href": "https://informer.example.com/api/sessions/00000000-0000-4000-8000-000000000001"
          }
        },
        "permissions": {},
        "id": "00000000-0000-4000-8000-000000000001",
        "host": "kubernetes.docker.internal",
        "ip": "127.0.0.1",
        "deviceType": null,
        "deviceVendor": null,
        "deviceModel": null,
        "osName": null,
        "osVersion": null,
        "browserName": "shot",
        "browserVersion": null,
        "requests": 3,
        "lastAccessedAt": "2026-01-15T16:20:00.000Z",
        "expiresAt": "2026-01-15T16:20:00.000Z",
        "data": {
          "proxyHeaders": {},
          "preferredView": "grid",
          "lastVisitedPage": "/datasets"
        },
        "createdAt": "2026-01-15T16:20:00.000Z",
        "updatedAt": "2026-01-15T16:20:00.000Z",
        "tenant": "acme",
        "username": "admin",
        "parent": null,
        "user": {
          "permissions": {
            "changeDomain": false,
            "changeProfile": true,
            "changePassword": false,
            "delete": false,
            "edit": true,
            "reassign": true,
            "superuser": true,
            "enable": true,
            "changeTheme": true,
            "lock": true,
            "setGlobalPermissions": true,
            "manageLogin": false
          },
          "displayName": "acme Administrator",
          "email": null,
          "timezone": "America/New_York",
          "tenant": "acme",
          "username": "admin"
        },
        "active": true
      },
      {
        "_links": {
          "self": {
            "href": "https://informer.example.com/api/sessions/00000000-0000-4000-8000-000000000002"
          }
        },
        "permissions": {},
        "id": "00000000-0000-4000-8000-000000000002",
        "host": "kubernetes.docker.internal",
        "ip": "127.0.0.1",
        "deviceType": null,
        "deviceVendor": null,
        "deviceModel": null,
        "osName": null,
        "osVersion": null,
        "browserName": "shot",
        "browserVersion": null,
        "requests": 0,
        "lastAccessedAt": "2026-01-15T16:20:00.000Z",
        "expiresAt": "2026-01-15T16:20:00.000Z",
        "data": {
          "proxyHeaders": {}
        },
        "createdAt": "2026-01-15T16:20:00.000Z",
        "updatedAt": "2026-01-15T16:20:00.000Z",
        "tenant": "acme",
        "username": "admin",
        "parent": null,
        "user": {
          "permissions": {
            "changeDomain": false,
            "changeProfile": true,
            "changePassword": false,
            "delete": false,
            "edit": true,
            "reassign": true,
            "superuser": true,
            "enable": true,
            "changeTheme": true,
            "lock": true,
            "setGlobalPermissions": true,
            "manageLogin": false
          },
          "displayName": "acme Administrator",
          "email": null,
          "timezone": "America/New_York",
          "tenant": "acme",
          "username": "admin"
        }
      }
    ]
  }
}

Captured from the API examples test suite; ids and timestamps are normalized.

Notes:

For manager tenant users, the role constraint is disabled to allow viewing all sessions
Sessions include device/browser fingerprinting for security tracking

GET /api/sessions/{id}

Retrieve details for a specific session.

Authentication: Required

Path Parameters:

Parameter	Type	Description
`id`	string	Session ID

Response: the session row with its embedded user (same shape as a list entry above).

DELETE /api/sessions/{id}

Terminate a specific session. Non-superusers can only delete their own sessions (the lookup is read-access scoped).

Authentication: Required

Terminate a session remotelyDELETE /api/sessions/00000000-0000-4000-8000-000000000001

Responds 200 with an empty body. Non-superusers can only delete their own sessions (read-access scoped).

Response · 200 · no body

Captured from the API examples test suite; ids and timestamps are normalized.

Use Cases:

Log out a specific device remotely
Terminate stale or compromised sessions
Force logout after password change

Security Consideration

Deleting a session immediately invalidates it. Any active requests using that session will fail with 401 Unauthorized.

DELETE /api/sessions/{id}/children

Delete all child sessions (impersonated sessions) for a given session.

Authentication: Required

Path Parameters:

Parameter	Type	Description
`id`	string	Parent session ID

Response:

204 No Content

Use Cases:

Clear all impersonation sessions when returning to home user
Clean up abandoned child sessions

GET /api/my-sessions

Get all sessions related to the current session (parent and children).

Authentication: Required

Pre-blocks: Current session lookup

List my active sessionsGET /api/my-sessions

One entry per signed-in device/browser for the calling user.

Response · 200

{
  "_links": {
    "self": {
      "href": "https://informer.example.com/api/my-sessions"
    }
  },
  "start": 0,
  "count": 1,
  "total": 1,
  "_embedded": {
    "inf:session": [
      {
        "_links": {
          "self": {
            "href": "https://informer.example.com/api/sessions/00000000-0000-4000-8000-000000000001"
          }
        },
        "permissions": {},
        "id": "00000000-0000-4000-8000-000000000001",
        "host": "kubernetes.docker.internal",
        "ip": "127.0.0.1",
        "deviceType": null,
        "deviceVendor": null,
        "deviceModel": null,
        "osName": null,
        "osVersion": null,
        "browserName": "shot",
        "browserVersion": null,
        "requests": 1,
        "lastAccessedAt": "2026-01-15T16:20:00.000Z",
        "expiresAt": "2026-01-15T16:20:00.000Z",
        "data": {
          "proxyHeaders": {}
        },
        "createdAt": "2026-01-15T16:20:00.000Z",
        "updatedAt": "2026-01-15T16:20:00.000Z",
        "tenant": "acme",
        "username": "admin",
        "parent": null,
        "user": {
          "permissions": {
            "changeDomain": false,
            "changeProfile": true,
            "changePassword": false,
            "delete": false,
            "edit": true,
            "reassign": true,
            "superuser": true,
            "enable": true,
            "changeTheme": true,
            "lock": true,
            "setGlobalPermissions": true,
            "manageLogin": false
          },
          "username": "admin",
          "displayName": "acme Administrator",
          "givenName": "acme",
          "enabled": true,
          "familyName": "Administrator",
          "middleName": null,
          "email": null,
          "settings": {
            "log": {
              "log": false,
              "info": false,
              "warn": false,
              "debug": false,
              "error": true,
              "remote": false
            }
          },
          "timezone": "America/New_York",
          "tenant": "acme",
          "superuser": true
        },
        "active": true
      }
    ]
  }
}

Captured from the API examples test suite; ids and timestamps are normalized.

Use Cases:

Display active sessions in user settings
Show impersonation hierarchy
Allow switching between related sessions

Related Sessions

This endpoint returns all sessions in the same hierarchy: the root session (no parent) and all descendant sessions created through impersonation.

GET /api/session

Get the current active session, enriched with everything the clients bootstrap from: fresh wsToken/goToken signatures, the tenant's licensed modules, maxAccessLevel, locale/lang, frameAncestors, and the embedded user.

Authentication: Required

Get the current sessionGET /api/session

Response · 200

{
  "_links": {
    "self": {
      "href": "https://informer.example.com/api/session"
    }
  },
  "permissions": {},
  "id": "00000000-0000-4000-8000-000000000001",
  "host": "kubernetes.docker.internal",
  "ip": "127.0.0.1",
  "deviceType": null,
  "deviceVendor": null,
  "deviceModel": null,
  "osName": null,
  "osVersion": null,
  "browserName": "shot",
  "browserVersion": null,
  "requests": 0,
  "lastAccessedAt": "2026-01-15T16:20:00.000Z",
  "expiresAt": "2026-01-15T16:20:00.000Z",
  "data": {
    "proxyHeaders": {}
  },
  "createdAt": "2026-01-15T16:20:00.000Z",
  "updatedAt": "2026-01-15T16:20:00.000Z",
  "tenant": "acme",
  "username": "admin",
  "parent": null,
  "ai": false,
  "wsToken": "eyJhbGciOiJIUzI1NiJ9.example-token-1.signature",
  "goToken": "eyJhbGciOiJIUzI1NiJ9.example-token-2.signature",
  "locale": "en",
  "lang": "en",
  "website": {
    "appLicenseUpgrade": "https://www.entrinsik.com/contact/?product=informer&utm_source=informer&utm_medium=in-app&utm_campaign=ai-upgrade"
  },
  "modules": {
    "salesforce": true,
    "apps": true
  },
  "maxAccessLevel": 0,
  "frameAncestors": [],
  "_embedded": {
    "inf:user": {
      "_links": {
        "self": {
          "href": "https://informer.example.com/api/users/admin"
        },
        "inf:memberships": {
          "href": "https://informer.example.com/api/users/admin/memberships"
        },
        "inf:avatar-upload": {
          "href": "https://informer.example.com/api/users/admin/_upload/{uploadId}/avatar-upload",
          "templated": true
        },
        "inf:password": {
          "href": "https://informer.example.com/api/users/admin/password"
        },
        "inf:feed": {
          "href": "https://informer.example.com/api/users/admin/feed"
        },
        "inf:viewed-feed": {
          "href": "https://informer.example.com/api/users/admin/_markFeedViewed"
        },
        "inf:superuser": {
          "href": "https://informer.example.com/api/users/admin/superuser"
        }
      },
      "permissions": {
        "changeDomain": false,
        "changeProfile": true,
        "changePassword": true,
        "delete": false,
        "edit": true,
        "reassign": true,
        "superuser": true,
        "enable": true,
        "changeTheme": true,
        "lock": true,
        "setGlobalPermissions": true,
        "manageLogin": true
      },
      "domain": "local",
      "username": "admin",
      "displayName": "acme Administrator",
      "familyName": "Administrator",
      "givenName": "acme",
      "middleName": null,
      "email": null,
      "data": null,
      "superuser": true,
      "timezone": "America/New_York",
      "settings": {
        "log": {
          "log": false,
          "info": false,
          "warn": false,
          "debug": false,
          "error": true,
          "remote": false
        }
      },
      "enabled": true,
      "source": null,
      "sourceId": null,
      "lastViewedFeed": null,
      "tenant": "acme",
      "globalPermissions": {
        "ai": false,
        "jobCreation": true,
        "viewAllTeams": true,
        "viewAllUsers": true,
        "painlessScriptCreation": true
      },
      "userFields": {},
      "locked": false,
      "lockedAt": null,
      "loginAttempts": 0,
      "passwordSetAt": "2026-01-15T16:20:00.000Z",
      "passwordExpiresAt": "2026-01-15T16:20:00.000Z",
      "forgotPasswordRequestTime": null,
      "mfa": null,
      "mfaConfig": {},
      "aiMessage": null,
      "aiConsent": false,
      "hasSharedDatasources": false,
      "createdAt": "2026-01-15T16:20:00.000Z",
      "updatedAt": "2026-01-15T16:20:00.000Z",
      "initials": "NA",
      "colorIndex": 4,
      "avatarColor": {
        "background": "#81C784",
        "text": "#1B5E20"
      },
      "managesPassword": true
    }
  }
}

Captured from the API examples test suite; ids and timestamps are normalized.

PUT /api/session/data

Update session data (custom metadata storage). The payload object itself is the data: it is shallow-merged onto the existing session.data (there is no data wrapper field).

Authentication: Required

Store data on the sessionPUT /api/session/data

The payload object is shallow-merged onto the existing session.data. Responds 200 with an empty body; data lives only as long as the session.

Request body

{
  "preferredView": "grid",
  "lastVisitedPage": "/datasets"
}

Response · 200 · no body

Captured from the API examples test suite; ids and timestamps are normalized.

Use Cases:

Store UI state
Cache user preferences temporarily
Track navigation history

Session Data Lifecycle

Session data is ephemeral and tied to the session lifetime. It is cleared when the session expires or is deleted.

GET /api/sessions​

GET /api/sessions/{id}​

DELETE /api/sessions/{id}​

DELETE /api/sessions/{id}/children​

GET /api/my-sessions​

GET /api/session​

PUT /api/session/data​

GET /api/sessions

GET /api/sessions/{id}

DELETE /api/sessions/{id}

DELETE /api/sessions/{id}/children

GET /api/my-sessions

GET /api/session

PUT /api/session/data