curl --request GET \
--url https://{tenant_id}.hanko.io/sessions/validate \
--cookie hanko=import requests
url = "https://{tenant_id}.hanko.io/sessions/validate"
headers = {"cookie": "hanko="}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {cookie: 'hanko='}};
fetch('https://{tenant_id}.hanko.io/sessions/validate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenant_id}.hanko.io/sessions/validate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_COOKIE => "hanko=",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{tenant_id}.hanko.io/sessions/validate"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("cookie", "hanko=")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://{tenant_id}.hanko.io/sessions/validate")
.header("cookie", "hanko=")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenant_id}.hanko.io/sessions/validate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["cookie"] = 'hanko='
response = http.request(request)
puts response.read_body{
"is_valid": true,
"expiration_time": "2023-11-07T05:31:56Z",
"user_id": "<string>",
"claims": {
"subject": "c339547d-e17d-4ba7-8a1d-b3d5a4d17c1c",
"expiration": "2023-11-07T05:31:56Z",
"session_id": "c339547d-e17d-4ba7-8a1d-b3d5a4d17c1c",
"issued_at": "2023-11-07T05:31:56Z",
"audience": [
"<string>"
],
"issuer": "<string>",
"email": {
"address": "jsmith@example.com",
"is_primary": true,
"is_verified": true
},
"amr": [
"pwd"
]
},
"idle_expires_at": "2023-11-07T05:31:56Z",
"organizations": [
{
"id": "c339547d-e17d-4ba7-8a1d-b3d5a4d17c1c",
"name": "<string>",
"roles": [
"<string>"
]
}
]
}{
"code": 400,
"message": "Bad Request"
}{
"code": 500,
"message": "Internal Server Error"
}Validate a session
Validate a session using a cookie header or an authorization header. This is a passive check that does not update the session’s internal last activity timestamp.
curl --request GET \
--url https://{tenant_id}.hanko.io/sessions/validate \
--cookie hanko=import requests
url = "https://{tenant_id}.hanko.io/sessions/validate"
headers = {"cookie": "hanko="}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {cookie: 'hanko='}};
fetch('https://{tenant_id}.hanko.io/sessions/validate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenant_id}.hanko.io/sessions/validate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_COOKIE => "hanko=",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{tenant_id}.hanko.io/sessions/validate"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("cookie", "hanko=")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://{tenant_id}.hanko.io/sessions/validate")
.header("cookie", "hanko=")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenant_id}.hanko.io/sessions/validate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["cookie"] = 'hanko='
response = http.request(request)
puts response.read_body{
"is_valid": true,
"expiration_time": "2023-11-07T05:31:56Z",
"user_id": "<string>",
"claims": {
"subject": "c339547d-e17d-4ba7-8a1d-b3d5a4d17c1c",
"expiration": "2023-11-07T05:31:56Z",
"session_id": "c339547d-e17d-4ba7-8a1d-b3d5a4d17c1c",
"issued_at": "2023-11-07T05:31:56Z",
"audience": [
"<string>"
],
"issuer": "<string>",
"email": {
"address": "jsmith@example.com",
"is_primary": true,
"is_verified": true
},
"amr": [
"pwd"
]
},
"idle_expires_at": "2023-11-07T05:31:56Z",
"organizations": [
{
"id": "c339547d-e17d-4ba7-8a1d-b3d5a4d17c1c",
"name": "<string>",
"roles": [
"<string>"
]
}
]
}{
"code": 400,
"message": "Bad Request"
}{
"code": 500,
"message": "Internal Server Error"
}Authorizations
Response
Session validation response
Indicates whether the session is valid or not
Date-time indicating the expiration of the session. Deprecated, please use claims.expiration instead.
The ID of the user the session is associated with. Deprecated, please use claims.subject instead.
The claims extracted from a JWT.
Show child attributes
Show child attributes
Timestamp (in UTC) indicating when the session will expire due to inactivity, assuming no further activity occurs before this time. Only present when idle timeout is configured. The value is capped to the JWT expiration time.
The organizations the user belongs to, and the role slugs they hold within each. Computed fresh from the database on every call, not embedded in the JWT, so a role or membership change takes effect immediately on the next validation call rather than only after the session token is reissued. Omitted if the user belongs to no organizations.
Show child attributes
Show child attributes