# List sessions

URL: https://docs.hanzo.ai/docs/openapi/iam/listsessions

> Returns who is currently signed in to an organization, newest first, and can be narrowed to one person or one application.

`GET /v1/iam/sessions`

> [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                        |
| ------------- | -------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/iam/sessions` |
| **Method**    | `GET`                                  |
| **Operation** | `listSessions`                         |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY` |

Returns who is currently signed in to an organization, newest first, and
can be narrowed to one person or one application. It is what you read before
signing someone out.

Which organization comes from your credentials, not from the request: you read
your own and no one else's. A session row names a live account and the
applications it is signed in to, so the tenant is decided here rather than
taken from the query.

## Request

3 fields.

| Field         | In    | Type   | Required | Description |
| ------------- | ----- | ------ | -------- | ----------- |
| `owner`       | query | string | —        |             |
| `name`        | query | string | —        |             |
| `application` | query | string | —        |             |

## Response

| Status    | Body                | Meaning           |
| --------- | ------------------- | ----------------- |
| `200`     | iam.ListSessionsOut | ok                |
| `202`     | Approval            | held for approval |
| `default` | problem-details     | refused           |

`200` body — 11 fields.

| Field                        | In   | Type               | Always | Description                                                                                                                                                            |
| ---------------------------- | ---- | ------------------ | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `sessions`                   | body | iam.Session\[]     | —      |                                                                                                                                                                        |
| `sessions[].application`     | body | string             | —      |                                                                                                                                                                        |
| `sessions[].createdAt`       | body | string (date-time) | —      |                                                                                                                                                                        |
| `sessions[].createdTime`     | body | string             | —      |                                                                                                                                                                        |
| `sessions[].deleted`         | body | boolean            | —      |                                                                                                                                                                        |
| `sessions[].exclusiveSignin` | body | boolean            | —      | ExclusiveSignin is a transient control flag (v1 xorm:"-"): a caller sets it on a create to collapse SessionId down to the single incoming cookie instead of appending. |
| `sessions[].id`              | body | string             | —      |                                                                                                                                                                        |
| `sessions[].name`            | body | string             | —      |                                                                                                                                                                        |
| `sessions[].owner`           | body | string             | —      |                                                                                                                                                                        |
| `sessions[].sessionId`       | body | string\[]          | —      |                                                                                                                                                                        |
| `sessions[].updatedAt`       | body | string (date-time) | —      |                                                                                                                                                                        |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo iam sessions list
```

**SDK**

**.ts**

```ts
import { Configuration, IamApi } from 'hanzoai';

const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.listSessions();
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import IamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = IamApi(client).list_sessions()
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.IamAPI.ListSessions(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, iam_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = iam_api::list_sessions(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.IamApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new IamApi(client).listSessions();
```

**HTTP**

```bash
curl https://api.hanzo.ai/v1/iam/sessions \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list_iam_applications"
         }
       }
     }'
```

---

[IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)