Skip to main content
GET
Validate a session

Authorizations

hanko
string
cookie
required

Response

Session validation response

is_valid
boolean

Indicates whether the session is valid or not

expiration_time
string<date-time>
deprecated

Date-time indicating the expiration of the session. Deprecated, please use claims.expiration instead.

user_id
string<uuid4>
deprecated

The ID of the user the session is associated with. Deprecated, please use claims.subject instead.

claims
object

The claims extracted from a JWT.

idle_expires_at
string<date-time>

Timestamp (in UTC) indicating when the session will expire due to inactivity, assuming no further activity occurs before this time. Only present when idle timeout is configured. The value is capped to the JWT expiration time.

organizations
object[]

The organizations the user belongs to, and the role slugs they hold within each. Computed fresh from the database on every call, not embedded in the JWT, so a role or membership change takes effect immediately on the next validation call rather than only after the session token is reissued. Omitted if the user belongs to no organizations.