Skip to content
OTA-Pulse Docs

List all shell sessions for an organisation

GET
/api/sessions
 
curl --request GET \
  --url 'https://example.com/api/sessions?organization_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&page=1&per_page=20' \
  --header 'Authorization: Bearer <token>'

Return all shell sessions for the organisation, newest first.

All filters are optional. Pagination is identical to the per-device endpoint. Requires org viewer access.

Authorizations

Section titled “ Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “ Query Parameters ”
organization_id
required
Organization Id
string format: uuid
page
Page
integer
default: 1 >= 1
per_page
Per Page
integer
default: 20 >= 1 <= 100
device_id
Any of:
string format: uuid

Filter by device

tier
Any of:
string

Filter by tier (standard/elevated/breakglass)

status
Any of:
string

Filter by status

user_id
Any of:
string format: uuid

Filter by opener user_id

since
Any of:
string format: date-time

Filter: sessions created at or after this ISO-8601 timestamp

until
Any of:
string format: date-time

Filter: sessions created before or at this ISO-8601 timestamp

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Successful Response

Media type application/json
SessionListResponse

Paginated list of session records.

object
items
required
Items
Array<object>
SessionResponse

Public representation of a shell session.

Secret / sensitive fields (client_ip, user_agent, recording_uri, recording_sha256) are intentionally EXCLUDED from this schema.

WebSocket connection fields (ws_url, ws_token, ws_expires_at) are populated only when the gateway is configured and the session was opened via POST /devices/{id}/sessions. They are None in list/get responses and in dev environments where the gateway is not running.

ws_token is included so the browser can supply it as a WebSocket subprotocol (Sec-WebSocket-Protocol) when opening ws_url — never appended to the URL query string, so it does not land in proxy access logs (GAP-FE-007). It is short-lived (~60 s) and single-use; do NOT persist it.

object
created_at
required
Created At
string format: date-time
device_id
required
Device Id
string format: uuid
ended_at
required
Any of:
string format: date-time
exit_reason
required
Any of:
string
id
required
Id
string format: uuid
justification
required
Any of:
string
organization_id
required
Organization Id
string format: uuid
recording
Recording
boolean
started_at
required
Any of:
string format: date-time
status
required
Status
string
tier
required
Tier
string
user_id
required
Any of:
string format: uuid
ws_expires_at
Any of:
string format: date-time
ws_token
Any of:
string
ws_url
Any of:
string
page
required
Page
integer
per_page
required
Per Page
integer
total
required
Total
integer
Example 
{
  "items": [
    {
      "recording": false
    }
  ]
}

422

Section titled “ 422 ”

Validation Error

Media type application/json
HTTPValidationError
object
detail
Detail
Array<object>
ValidationError
object
ctx
Context
object
input
Input
loc
required
Location
Array
msg
required
Message
string
type
required
Error Type
string
Example generated 
{
  "detail": [
    {
      "ctx": {},
      "input": "example",
      "loc": [
        "example"
      ],
      "msg": "example",
      "type": "example"
    }
  ]
}