Session management

In the Hanzo IAM admin panel, view active sessions and end them individually or in bulk. Admins and users can control which devices or browsers stay signed in.

Viewing sessions

1. Open Sessions in the sidebar.
2. You’ll see all active sessions for the organization, with user, application, creation time, and session IDs.

Each row is one user–application pair; multiple session IDs in a row mean the user is signed in from more than one device or browser.

Deleting a single session

Ending a specific session revokes access from that device or browser only. Use this to:

• Revoking access from a lost or stolen device
• Terminating a suspicious login from an unfamiliar location
• Managing sessions across multiple devices individually
• Logging out from specific browsers while staying logged in elsewhere

Steps

On the Sessions list, each session’s IDs appear as tags. To remove one:

1. Find the session row.
2. Click the × on the session ID tag you want to end.
3. Confirm in the dialog.

That session is invalidated immediately; the user is signed out on that device or browser only.

Current session protection

The session you are currently using cannot be deleted. Attempting to delete it shows:

Use the normal logout flow to sign out of your current session.

Deleting all sessions

When you delete a session record entirely (not just a single session ID), Hanzo IAM handles it intelligently:

• If the session record has multiple session IDs, deleting one ID removes just that session
• If only one session ID remains and you delete it, the entire session record is removed
• Delete the entire session record with the row's delete button

Deleting all sessions for a user effectively logs them out from all devices and browsers simultaneously.

Session API

The session resource is five typed operations under /v1/iam/sessions. Every one is a POST, including the reads: the (owner, name, application) key travels on the request body rather than as path or query parameters, so the same registration serves REST, OpenAPI and MCP from one shape.

List sessions

owner is required; name and application narrow the result. Newest first.

curl -X POST https://api.hanzo.ai/v1/iam/sessions/list \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"owner": "organization-name"}'

Delete a session record

Delete addresses one record by its full key — all three fields are required. It removes the record and every session ID in it, so the browsers carrying those cookies stop being authenticated.

curl -X POST https://api.hanzo.ai/v1/iam/sessions/delete \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "owner": "organization-name",
    "name": "username",
    "application": "app-name"
  }'

{ "deleted": true }

A session that is already gone reports {"deleted": false} rather than an error, so the call is safe to repeat.

Remove one session ID

There is no sessionId parameter on delete. To drop a single ID and keep the rest, update the record with the list you want to retain — sessionId replaces the stored list:

curl -X POST https://api.hanzo.ai/v1/iam/sessions/update \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "owner": "organization-name",
    "name": "username",
    "application": "app-name",
    "sessionId": ["keep-this-one", "and-this-one"]
  }'

The list is capped at the newest 100 IDs per record, so a long-lived principal cannot grow the row without limit.

Session Cleanup

Hanzo IAM automatically cleans up expired sessions based on your session timeout configuration. You don't need to manually delete expired sessions unless you want to revoke access immediately before the automatic expiration.

Best Practices

Use individual session deletion for security incidents: If you detect suspicious activity from a specific device, delete just that session ID rather than logging the user out everywhere.

Educate users on session management: Users should know how to view their active sessions and remove ones they don't recognize. Consider adding a "My Sessions" page in your application that integrates with Hanzo IAM's session API.

Monitor session patterns: Unusual numbers of concurrent sessions may indicate account sharing or credential compromise. Regular session audits can help identify security issues.

Clean up old sessions regularly: While Hanzo IAM handles automatic expiration, periodically review and clean up abandoned sessions to maintain good hygiene in your session database.

Related Documentation

• Sign-out: RP-initiated logout and token revocation
• Session Overview: Understand session concepts in Hanzo IAM
• Tokens: How sessions relate to access tokens