---
title: "Session management"
---

> Documentation Index
> Fetch the complete documentation index at: https://kmworks.date/llms.txt
> Use this file to discover all available pages before exploring further.

# Session management

Signed-in browsers and devices hold server-side sessions (persisted in `sessions.sqlite` with the default `jdbc-session-enabled: true`). The Java version exposes these only through `/actuator/sessions`; kmrs adds REST endpoints and UI for them. The endpoints are kmrs-native and absent from the OpenAPI spec.

## Your own sessions

`GET /api/v2/users/me/sessions` — the caller's active sessions: `id`, `creationTime`, `lastAccessedTime`, and `current` marking the session the request authenticated with.

`DELETE /api/v2/users/me/sessions/{id}` — ends one of the caller's own sessions; sessions belonging to someone else read as missing (404).

The account security page lists them between the password form and the login activity, with the current session marked.

## All sessions (administrators)

`GET /api/v2/users/sessions` — every active session with its owner, most recently active first: `id`, `userId`, `email` (`null` when the session's user no longer exists), `creationTime`, `lastAccessedTime`.

`DELETE /api/v2/users/sessions/{id}` — ends any session, signing that device out.

The admin users page lists them above the authentication activity.

Source: https://kmworks.date/server/enhancements/session-management/index.mdx