Management sessions
Management routes require an admin-console token. End-user session controls are documented under Account portal API.
| Method | Route | Purpose |
|---|---|---|
| GET | /api/v1/management/sessions | List sessions with parsed pagination filters. |
| GET | /api/v1/management/sessions/{id} | Read by internal session ID. |
| GET | /api/v1/management/sessions/by-sid/{sid} | Read by OIDC sid. |
| DELETE | /api/v1/management/sessions/{id} | Revoke one session. |
| POST | /api/v1/management/sessions/revoke-by-user | Revoke sessions for a user. |
Revocation is enforced by protected APIs through the session blacklist. Access tokens associated with a revoked session are rejected even before their normal expiry.