Get my session state
Returns the current state of the current session including its factors and all currently satisfied assurance levels. `assurance_levels[]` may shrink over time as factor freshness windows expire, without the session itself expiring. Use step-up authentication (a new `auth_attempt` against the same `session_id`) to restore a dropped assurance level.
Returns the current state of the current session including its factors and all currently satisfied assurance levels.
assurance_levels[] may shrink over time as factor freshness windows expire,
without the session itself expiring. Use step-up authentication (a new auth_attempt
against the same session_id) to restore a dropped assurance level.
nextgenSession__nextgen_session<token>The __nextgen_session cookie issued at session creation or superseding handoff exchange.
A missing or invalid cookie yields 401 with code auth.unauthorized and the message
Missing or invalid session token.
Cross-site request forgery (ADR 053 §5): a state-changing request that this
cookie authenticates must come from the same origin — a cross-site browser
request is refused with 403 and code auth.csrf_invalid. Every such
request must also send the session's token from GET /sessions/me/csrf in the
X-Zitadel-CSRF header, or it answers the same 403. The only exceptions are
sign-out (revokeMySession) and the POST …/query reads, which need no
token. Safe methods (GET) are not checked. A request a project secret
authenticates is not affected.
Session state.
application/json- response
The current state of a session.
A session is the durable post-auth primitive. It accumulates verified authentication
factors and exposes assurance_levels[] — the set of assurance profiles its current
factors satisfy. Sessions are read-only from the client's perspective: factors flow
in through auth_attempts.
session_id*session-idUnique identifier for this session (dialect-minted prefixed opaque string).
^sess_[a-zA-Z0-9_-]+$project_id*project-id^[a-zA-Z0-9_-]+$state*stringCurrent lifecycle state of the session:
building: no verified authentication factors yetactive: has at least one verified authentication factor;assurance_levels[]may shrink as factors ageexpired: TTL elapsed
"building""active""expired"user_id?|The authenticated user. Null for anonymous sessions and until the user
factor has been verified through an auth_attempt.
user?The authenticated user's resolved reference, derived live from the
user schema's x-identifier/x-display designations (ADR 058).
Present on identity-hydrating reads (GET /sessions/me, session get
and query) whenever the session has an authenticated user; absent
for anonymous sessions. Clients render display, falling back to
identifier, then user_id.
factors*array<>Verified authentication factors accumulated by this session.
Each key is a factor type (e.g. password, totp, passkey).
Each value is a factor event object with at least verified_at and
method-specific properties (e.g. user_verified, hardware for passkeys).
assurance_levels?array<string>All assurance levels whose schemas the current session factors satisfy. This list shrinks as factor freshness windows expire and grows when step-up auth_attempts add or refresh factors. Whether any level is "enough" is determined by the request context, not the session.
metadata?|Arbitrary key/value metadata attached to the session.
user_agent?|User agent information captured at session creation.
created_at*stringWhen this session was created.
date-timeexpires_at*stringWhen this session expires. Short TTL (10 min) for anonymous sessions; reset to the full configured session TTL once the first authentication factor is written.
date-timecurl -X GET 'https://example.com/sessions/me'{ "session_id": "string", "project_id": "string", "state": "building", "user_id": "string", "user": { "user_id": "string", "identifier": "string", "identifier_property": "string", "display": "string" }, "factors": [ { "method": "identifier", "verified_at": "2019-08-24T14:15:22Z", "payload": { "method": "identifier", "user_id": "string" } } ], "assurance_levels": [ "string" ], "metadata": {}, "user_agent": { "fingerprint": "string", "ip": "string" }, "created_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z"}