Sessions

GET    /orgs/{orgId}/api/v1/admin/sessions
DELETE /orgs/{orgId}/api/v1/admin/sessions/{sessionId}
POST   /orgs/{orgId}/api/v1/admin/sessions/revoke-all
GET    /orgs/{orgId}/api/v1/admin/sessions/stats
GET    /orgs/{orgId}/api/v1/admin/sessions/count
GET    /orgs/{orgId}/api/v1/admin/users/{userId}/sessions
DELETE /orgs/{orgId}/api/v1/admin/users/{userId}/sessions
POST   /orgs/{orgId}/api/v1/admin/users/{userId}/sessions/revoke
GET    /orgs/{orgId}/api/v1/admin/tokens
DELETE /orgs/{orgId}/api/v1/admin/tokens/{tokenId}
DELETE /orgs/{orgId}/api/v1/admin/users/{userId}/tokens
POST   /orgs/{orgId}/api/v1/admin/users/{userId}/tokens/revoke
DELETE /orgs/{orgId}/api/v1/admin/clients/{clientId}/tokens
POST   /orgs/{orgId}/api/v1/admin/clients/{clientId}/tokens/revoke
GET    /orgs/{orgId}/api/v1/oauth/check_session

Sessions represent active user logins. Each session tracks when and how a user authenticated, their device, and can be individually revoked for security purposes.

note

This page documents the admin API for managing any user's sessions. End users manage their own sessions from the account portal via GET /account/sessions, POST /account/sessions/{id}/revoke, and POST /account/sessions/revoke-all (browser-session authenticated, not org-scoped).

Authentication

All session management endpoints require an API key or a Bearer token with admin:sessions:read / admin:sessions:write (a Bearer token may carry the blanket admin scope instead), or a browser session.

Each endpoint needs the credential's scope and a permission. A session or Bearer caller must hold the permission; for an API key its creator must still hold it. A missing permission returns 403 forbidden with details.required_permissions. See Required permissions.

Method	Endpoint	Permission	API-key / token scope
GET	`/admin/sessions`	`users.view`	`admin:sessions:read`
GET	`/admin/users/{userId}/sessions`	`users.view`	`admin:sessions:read`
DELETE	`/admin/sessions/{sessionId}`	`users.edit`	`admin:sessions:write`
DELETE	`/admin/users/{userId}/sessions`	`users.edit`	`admin:sessions:write`
GET	`/admin/tokens`	`users.view`	`admin:sessions:read`
DELETE	`/admin/tokens/{tokenId}`	`users.edit`	`admin:sessions:write`
DELETE	`/admin/users/{userId}/tokens`	`users.edit`	`admin:sessions:write`
POST	`/admin/users/{userId}/sessions/revoke`	`users.edit`	`admin:sessions:write`
POST	`/admin/sessions/revoke-all`	`users.edit`	`admin:sessions:write`
POST	`/admin/users/{userId}/tokens/revoke`	`users.edit`	`admin:sessions:write`
POST	`/admin/clients/{clientId}/tokens/revoke`	`clients.edit`	`admin:sessions:write`
DELETE	`/admin/clients/{clientId}/tokens`	`clients.edit`	`admin:sessions:write`
GET	`/admin/sessions/stats`	`users.view`	`admin:sessions:read`
GET	`/admin/sessions/count`	`users.view`	`admin:sessions:read`

Session Object

Session Object
{
  "id": 1544,
  "userId": "019d6190-9bba-7b5f-a0a5-07a6d10184d2",
  "userEmail": "john@acme.com",
  "ipAddress": "203.0.113.45",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...",
  "createdAt": "2026-03-01T08:00:00Z",
  "lastActivityAt": "2026-03-01T09:30:00Z",
  "expiresAt": "2026-03-02T08:00:00Z",
  "isActive": true
}

note

Session and token id values are opaque integers (e.g. 1544). The {sessionId} / {tokenId} path placeholders in the examples below take these integer IDs.

List All Sessions

curl
Node
Python
Go

List Sessions
curl "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions?limit=50" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions?limit=50", {
  method: "GET",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.get(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions?limit=50",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("GET", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions?limit=50", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Query Parameters

Parameter	Description
`page`	Page number (default: 1)
`limit`	Results per page (default: 25, max: 100)
`userId`	Filter sessions for a specific user

Only active sessions are listed; there is no status filter.

List User Sessions

curl
Node
Python
Go

List Sessions for a Specific User
curl "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions", {
  method: "GET",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.get(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("GET", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Session Statistics

Get Statistics

curl
Node
Python
Go

Get Session Statistics
curl "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/stats" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/stats", {
  method: "GET",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.get(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/stats",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("GET", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/stats", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Stats Response
{
  "data": {
    "total": 284,
    "active": 142,
    "inactive": 142
  }
}

Get Active Session Count

curl
Node
Python
Go

Get Active Session Count
curl "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/count" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/count", {
  method: "GET",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.get(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/count",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("GET", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/count", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Count Response
{
  "data": { "count": 142 }
}

Revoke Sessions

Revoke a Single Session

curl
Node
Python
Go

Revoke Single Session
curl -X DELETE \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/1544" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/1544", {
  method: "DELETE",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.delete(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/1544",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("DELETE", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/1544", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Revoke All Sessions for a User

Signs the user out everywhere. Every access token issued to the user before this call, JWT or opaque, stops working at once (introspection returns active: false, UserInfo and LumoAuth APIs reject it) and their refresh tokens get invalid_grant, AAuth tokens included.

curl
Node
Python
Go

Force Logout a User (DELETE)
curl -X DELETE \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions", {
  method: "DELETE",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.delete(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("DELETE", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

curl
Node
Python
Go

Force Logout a User (POST)
curl -X POST \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions/revoke" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions/revoke", {
  method: "POST",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.post(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions/revoke",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("POST", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../sessions/revoke", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Revoke All Organization Sessions

Revokes all active sessions for every user in the organization and invalidates every user access and refresh token issued before the call. Requires explicit confirmation.

curl
Node
Python
Go

Revoke All Sessions (organization-wide)
curl -X POST \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/revoke-all" \
  -H "Authorization: ApiKey lmk_abc123" \
  -H "Content-Type: application/json" \
  -d '{"confirm": true}'

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/revoke-all", {
  method: "POST",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" },
  body: JSON.stringify({"confirm": true})
});
console.log(await resp.json());

import os, requests

resp = requests.post(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/revoke-all",
    headers={"Authorization": os.environ["LUMO_AUTH"], "Content-Type": "application/json"},
    json={"confirm": True}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

body := strings.NewReader(`{"confirm": true}`)
    req, _ := http.NewRequest("POST", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/sessions/revoke-all", body)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
    req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

warning

This signs out all users in the organization simultaneously. Use with caution.

Token Management

Revoke active access or refresh tokens without terminating the session.

List Active Tokens

curl
Node
Python
Go

List Active Tokens
curl "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/tokens?userId=01JF3KUSER..." \
  -H "Authorization: ApiKey lmk_abc123"

Filters: userId, clientId and revoked (true/false), plus page and limit.

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/tokens?userId=01JF3KUSER...", {
  method: "GET",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.get(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/tokens?userId=01JF3KUSER...",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("GET", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/tokens?userId=01JF3KUSER...", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Revoke a Token

curl
Node
Python
Go

Revoke a Token
curl -X DELETE \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/tokens/2087" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/tokens/2087", {
  method: "DELETE",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.delete(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/tokens/2087",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("DELETE", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/tokens/2087", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Revoke All Tokens for a User

curl
Node
Python
Go

Revoke All User Tokens (DELETE)
curl -X DELETE \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../tokens" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../tokens", {
  method: "DELETE",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.delete(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../tokens",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("DELETE", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../tokens", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

curl
Node
Python
Go

Revoke All User Tokens (POST)
curl -X POST \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../tokens/revoke" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../tokens/revoke", {
  method: "POST",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.post(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../tokens/revoke",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("POST", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/users/01JF3KUSER.../tokens/revoke", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

Revoke All Tokens for a Client

curl
Node
Python
Go

Revoke All Client Tokens (DELETE)
curl -X DELETE \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/clients/my-app/tokens" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/clients/my-app/tokens", {
  method: "DELETE",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.delete(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/clients/my-app/tokens",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("DELETE", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/clients/my-app/tokens", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

curl
Node
Python
Go

Revoke All Client Tokens (POST)
curl -X POST \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/clients/my-app/tokens/revoke" \
  -H "Authorization: ApiKey lmk_abc123"

const resp = await fetch("https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/clients/my-app/tokens/revoke", {
  method: "POST",
  headers: { "Authorization": process.env.LUMO_AUTH, "Content-Type": "application/json" }
});
console.log(await resp.json());

import os, requests

resp = requests.post(
    "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/clients/my-app/tokens/revoke",
    headers={"Authorization": os.environ["LUMO_AUTH"]}
)
print(resp.json())

import (
    "io"
    "net/http"
    "os"
    "strings"
)

req, _ := http.NewRequest("POST", "https://app.lumoauth.dev/orgs/acme-corp/api/v1/admin/clients/my-app/tokens/revoke", nil)
    req.Header.Set("Authorization", os.Getenv("LUMO_AUTH"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(string(out))

OIDC check_session

GET /orgs/{orgId}/api/v1/oauth/check_session

Implements the OpenID Connect Session Management specification. Load this URL in a hidden iframe within your relying party (the app that relies on LumoAuth for sign-in) to detect session state changes (e.g., logout in another tab). Read the iframe URL from the discovery document's check_session_iframe rather than hard-coding it; the full protocol is on the Logout page:

check_session iframe (JavaScript)
const iframe = document.createElement("iframe");
iframe.src = "https://app.lumoauth.dev/orgs/acme-corp/api/v1/oauth/check_session";
iframe.style.display = "none";
document.body.appendChild(iframe);

setInterval(() => {
  iframe.contentWindow.postMessage(
    `${clientId} ${sessionState}`,
    "https://app.lumoauth.dev"
  );
}, 3000);

window.addEventListener("message", (event) => {
  if (event.origin !== "https://app.lumoauth.dev") return;
  if (event.data === "changed") {
    // Session changed — re-authenticate
  }
});

tip

The session_state value is returned in the authorization response. Store it and include it in postMessage calls.

Authentication​

Session Object​

List All Sessions​

Query Parameters​

List User Sessions​

Session Statistics​

Get Statistics​

Get Active Session Count​

Revoke Sessions​

Revoke a Single Session​

Revoke All Sessions for a User​

Revoke All Organization Sessions​

Token Management​

List Active Tokens​

Revoke a Token​

Revoke All Tokens for a User​

Revoke All Tokens for a Client​

OIDC check_session​