Validate a session

Validate a session using a cookie header or an authorization header. This is a passive check that does not update the session’s internal last activity timestamp.

GET /sessions/validate

Validate a session

cURL

curl --request GET \
  --url https://{tenant_id}.hanko.io/sessions/validate \
  --cookie hanko=

200

{
  "is_valid": true,
  "expiration_time": "2023-11-07T05:31:56Z",
  "user_id": "<string>",
  "claims": {
    "subject": "c339547d-e17d-4ba7-8a1d-b3d5a4d17c1c",
    "expiration": "2023-11-07T05:31:56Z",
    "session_id": "c339547d-e17d-4ba7-8a1d-b3d5a4d17c1c",
    "issued_at": "2023-11-07T05:31:56Z",
    "audience": [
      "<string>"
    ],
    "issuer": "<string>",
    "email": {
      "address": "[e-mail]",
      "is_primary": true,
      "is_verified": true
    },
    "amr": [
      "pwd"
    ]
  },
  "idle_expires_at": "2023-11-07T05:31:56Z"
}

Authorizations

CookieAuthBearerTokenAuth

hanko · string · cookie · required

Response

200

application/json

Session validation response

is_valid · boolean

Indicates whether the session is valid or not

expiration_time · string<date-time> · deprecated

Date-time indicating the expiration of the session. Deprecated, please use claims.expiration instead.

user_id · string<uuid4> · deprecated

The ID of the user the session is associated with. Deprecated, please use claims.subject instead.

claims · object

The claims extracted from a JWT.

Show child attributes

idle_expires_at · string<date-time>

Timestamp (in UTC) indicating when the session will expire due to inactivity, assuming no further activity occurs before this time. Only present when idle timeout is configured. The value is capped to the JWT expiration time.