> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Sessions

> List agent sessions with filtering by agent, status, and pagination

# List Sessions

`GET /v1/agent-sessions`

Returns a paginated list of agent sessions for the authenticated tenant. Results can be filtered by agent ID and session status. Sessions are returned in reverse chronological order (newest first).

### Authentication

Requires `X-API-Key` header or Bearer JWT token. Tenant-scoped via `X-Tenant-ID`.

### Query Parameters

<ParamField query="agent_id" type="string">
  Filter sessions by the owning agent's MAIP identifier (e.g.,
  `maip:t1234567:01HYX3KPZQ7RJGBN0WFMV8SDEH`).
</ParamField>

<ParamField query="status" type="string">
  Filter by session status. One of: `"active"`, `"expired"`, `"terminated"`,
  `"handed_off"`.
</ParamField>

<ParamField query="limit" type="integer">
  Maximum number of sessions to return per page. Range: 1-200. Default: `50`.
</ParamField>

<ParamField query="offset" type="integer">
  Number of records to skip for pagination. Default: `0`.
</ParamField>

### Response

<ResponseField name="sessions" type="object[]">
  Array of session objects. Each contains `session_id`, `agent_id`, `status`,
  `scopes`, `metadata`, `expires_at`, `parent_session_id`, `handed_off_to`,
  `ip_address`, `user_agent`, `refreshed_at`, `terminated_at`, `created_at`, and
  `updated_at`. Token hashes are never exposed in list responses.
</ResponseField>

<ResponseField name="total" type="integer">
  Total count of sessions matching the filter criteria, across all pages.
</ResponseField>

### Example

```bash theme={null}
curl -G https://api.truthlocks.com/v1/agent-sessions \
  -H "X-API-Key: tl_live_..." \
  -d "agent_id=maip:t1234567:01HYX3KPZQ7RJGBN0WFMV8SDEH" \
  -d "status=active" \
  -d "limit=25" \
  -d "offset=0"
```

***

### Session Status Reference

| Status       | Description                                          |
| ------------ | ---------------------------------------------------- |
| `active`     | Session is valid and accepting requests              |
| `expired`    | Session TTL has elapsed; no longer valid             |
| `terminated` | Session was explicitly terminated via API            |
| `handed_off` | Session was transferred to another agent via handoff |


## OpenAPI

````yaml mint-openapi.yaml GET /v1/agent-sessions
openapi: 3.0.3
info:
  title: Truthlocks API
  description: >
    Truthlocks is a universal verification infrastructure for documents,
    credentials, and digital assets.

    This specification defines the canonical API for interacting with Truthlocks
    services.


    ## Base URLs

    - **Production**: `https://api.truthlocks.com`

    - **Sandbox**: `https://sandbox-api.truthlocks.com`


    ## Authentication

    - **API Keys**: Use `X-API-Key` header for machine-to-machine operations

    - **Bearer Tokens**: Use `Authorization: Bearer <jwt>` for user-initiated
    operations


    ## Tenant Identity

    In production, tenant identity is derived from the authenticated context
    (API key or JWT).

    The `X-Tenant-ID` header is ignored in production to prevent spoofing.
  version: 1.0.0
  contact:
    name: Truthlocks Support
    url: https://truthlocks.com/support
    email: support@truthlocks.com
servers:
  - url: https://api.truthlocks.com
    description: Production API
  - url: https://sandbox-api.truthlocks.com
    description: Sandbox Environment
security:
  - APIKey: []
tags:
  - name: Authentication
    description: API key and token management
  - name: Issuers
    description: Issuer registration and trust management
  - name: Keys
    description: Cryptographic key management for issuers
  - name: Attestations
    description: Attestation lifecycle (mint, revoke, supersede)
  - name: Verification
    description: Attestation verification and proof bundles
  - name: Governance
    description: Issuer governance workflows (admin only)
  - name: Identity
    description: Organization, user, and role management
  - name: Audit
    description: Audit event queries
  - name: Platform
    description: Platform administration (super admin only)
  - name: Platform Review
    description: Staff review workflows for issuer applications
  - name: Tenant Console
    description: Tenant profile and lifecycle endpoints
  - name: Health
    description: Service health and readiness endpoints
  - name: Risk
    description: Risk signal ingestion and fraud detection
  - name: Risk Enforcement
    description: Risk enforcement actions — block, challenge, quarantine, and configuration
  - name: Billing
    description: Billing, subscription, and addon management
  - name: Machine Identity
    description: >-
      Machine Agent Identity Protocol (MAIP) — agent registration, sessions,
      trust, witness, compliance, orchestration, and observability
externalDocs:
  description: Transparency read-only API (separate service spec)
  url: >-
    https://github.com/truthlocks/truthlock/blob/main/docs/transparency/openapi.yaml
paths:
  /v1/agent-sessions:
    get:
      tags:
        - Machine Identity
      summary: List Sessions
      description: >-
        Returns a paginated list of sessions optionally filtered by agent or
        status.
      operationId: maip.sessions.list
      parameters:
        - name: agent_id
          in: query
          schema:
            type: string
            format: uuid
          description: Filter sessions by agent
        - name: status
          in: query
          schema:
            type: string
            enum:
              - active
              - terminated
              - expired
          description: Filter by session status
        - name: limit
          in: query
          schema:
            type: integer
            default: 25
            minimum: 1
            maximum: 100
        - name: offset
          in: query
          schema:
            type: integer
            default: 0
            minimum: 0
      responses:
        '200':
          description: Paginated list of sessions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MaipSessionList'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - APIKey: []
components:
  schemas:
    MaipSessionList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/MaipSession'
        total:
          type: integer
    ErrorEnvelope:
      type: object
      required:
        - code
        - message
        - http_status
      properties:
        code:
          type: string
          description: Machine-readable error code
          enum:
            - AUTH_REQUIRED
            - AUTH_INVALID
            - PERMISSION_DENIED
            - TENANT_IDENTITY_UNVERIFIED
            - NOT_FOUND
            - VALIDATION_ERROR
            - CONFLICT
            - PAYLOAD_TOO_LARGE
            - RATE_LIMIT_EXCEEDED
            - QUOTA_EXCEEDED
            - SERVICE_UNAVAILABLE
            - INTERNAL_ERROR
        message:
          type: string
          description: Human-readable error message
        http_status:
          type: integer
          description: HTTP status code
        retry_after_ms:
          type: integer
          description: Milliseconds to wait before retrying (for rate limits)
        details:
          type: object
          description: Additional error context
      example:
        code: AUTH_REQUIRED
        message: Authentication required
        http_status: 401
    MaipSession:
      type: object
      properties:
        session_id:
          type: string
          format: uuid
        agent_id:
          type: string
          format: uuid
        token:
          type: string
          description: Session bearer token (returned once on creation)
        scopes:
          type: array
          items:
            type: string
        status:
          type: string
          enum:
            - active
            - terminated
            - expired
        metadata:
          type: object
          additionalProperties: true
        expires_at:
          type: string
          format: date-time
        created_at:
          type: string
          format: date-time
        terminated_at:
          type: string
          format: date-time
  securitySchemes:
    APIKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key for machine-to-machine authentication

````