[HELP] I can't read list my own sessions

Hello, I am trying to list my own sessions with this endpoint https://zitadel.com/docs/apis/resources/session_service_v2/session-service-list-sessions :

curl --location 'http://localhost:8080/v2/sessions/search' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "sortingColumn": "SESSION_FIELD_NAME_UNSPECIFIED"
}
'

curl --location 'http://localhost:8080/v2/sessions/search' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "sortingColumn": "SESSION_FIELD_NAME_UNSPECIFIED"
}
'

curl --location 'http://localhost:8080/v2/sessions/search' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "sortingColumn": "SESSION_FIELD_NAME_UNSPECIFIED"
}
'

curl --location 'http://localhost:8080/v2/sessions/search' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "sortingColumn": "SESSION_FIELD_NAME_UNSPECIFIED"
}
'

But I get this :

{
    "code": 16,
    "message": "Errors.Token.Invalid (AUTH-7fs1e)",
    "details": [
        {
            "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
            "id": "AUTH-7fs1e",
            "message": "Errors.Token.Invalid"
        }
    ]
}

{
    "code": 16,
    "message": "Errors.Token.Invalid (AUTH-7fs1e)",
    "details": [
        {
            "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
            "id": "AUTH-7fs1e",
            "message": "Errors.Token.Invalid"
        }
    ]
}

{
    "code": 16,
    "message": "Errors.Token.Invalid (AUTH-7fs1e)",
    "details": [
        {
            "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
            "id": "AUTH-7fs1e",
            "message": "Errors.Token.Invalid"
        }
    ]
}

{
    "code": 16,
    "message": "Errors.Token.Invalid (AUTH-7fs1e)",
    "details": [
        {
            "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
            "id": "AUTH-7fs1e",
            "message": "Errors.Token.Invalid"
        }
    ]
}

ZITADEL Docs

Searches for sessions matching the given query. You can search by session ID, user ID,

Ask Inkeep•12/10/25, 8:47 AM

Hi @Angel, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

Ask Inkeep•12/10/25, 8:48 AM

Answer

The Errors.Token.Invalid (AUTH-7fs1e) Errors.Token.Invalid (AUTH-7fs1e) error typically indicates an issue with the token you're using for authentication. (1) (2)

A few things to check:

Include the required scope – When requesting your access token, make sure to include the scope
```
urn:zitadel:iam:org:project🆔zitadel:aud
```
```
urn:zitadel:iam:org:project🆔zitadel:aud
```
to allow the token to be used against ZITADEL APIs. (3)
Verify the token type – The Session Service API requires OAuth 2.0 authentication. Ensure you're using a valid access token (not a session token, which is opaque and requires different handling) . (4) (5)
Check the Authorization header format – Ensure your header is formatted as Authorization: Bearer <your_token>Authorization: Bearer <your_token>.
Verify issuer configuration – If you're self-hosting, ensure the issuer in your JWT matches your ZITADEL instance's configured external URL exactly (including scheme and port) . (2)

If you're still encountering issues after checking these items, click the "Ask for help" button to have a team member review your question.

Ask Inkeep•12/10/25, 8:48 AM

To learn more, see the sources I considered:

[1] Discord message from @geo_space on 2024-01-27
[2] Use a single token verifier in the auth middleware
[3] Using a token that can access the introspection endpoint for using the API
[4] Session Service
[5] Choose organization on login

Ask Inkeep•12/10/25, 8:48 AM

Feel free to tag @Ask Inkeep with additional questions.

AngelOP•12/10/25, 8:55 AM

@Ask Inkeepadding

urn:zitadel:iam:org:project🆔zitadel:aud

urn:zitadel:iam:org:project🆔zitadel:aud

works but that gives me every sessions and not just while I don't have session.readsession.read permission

Ask Inkeep•12/10/25, 8:55 AM

Thanks for the follow-up, @Angel. I'll get back to you soon.

Ask Inkeep•12/10/25, 8:56 AM

Answer

To list only your own sessions, you need to add a query filter to your request. The List Sessions endpoint supports a userIdQueryuserIdQuery or creatorQuerycreatorQuery to filter results. (1)

To get only sessions belonging to the authenticated user, add the creatorQuerycreatorQuery with an empty

id

id

field—this will use the calling user's ID:

{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "queries": [
    {
      "creatorQuery": {
        "id": ""
      }
    }
  ],
  "sortingColumn": "SESSION_FIELD_NAME_UNSPECIFIED"
}

{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "queries": [
    {
      "creatorQuery": {
        "id": ""
      }
    }
  ],
  "sortingColumn": "SESSION_FIELD_NAME_UNSPECIFIED"
}

Alternatively, you can use userIdQueryuserIdQuery with your specific user ID:

{
  "queries": [
    {
      "userIdQuery": {
        "id": "<your-user-id>"
      }
    }
  ]
}

{
  "queries": [
    {
      "userIdQuery": {
        "id": "<your-user-id>"
      }
    }
  ]
}

According to the documentation, no permission is required to search for your own sessions when using these filters.

Ask Inkeep•12/10/25, 8:56 AM

To learn more, see the sources I considered:

[1] List sessions

Ask Inkeep•12/10/25, 8:56 AM

Feel free to tag @Ask Inkeep with additional questions.

AngelOP•12/10/25, 9:00 AM

@Ask Inkeep{
"queries": [
{
"userIdQuery": {
"id": "<your-user-id>"
}
}
]
}

this query work but the user shouldn't have the ability to read other sessions

Ask Inkeep•12/10/25, 9:00 AM

Thanks for the follow-up, @Angel. I'll get back to you soon.

Ask Inkeep•12/10/25, 9:00 AM

Answer

You raise a valid concern. According to the documentation, the List Sessions endpoint requires session.readsession.read permission, with an exception: "no permission required to search for own sessions." (1)

However, the documentation doesn't explicitly detail how the API restricts access when using userIdQueryuserIdQuery with another user's ID versus your own. Based on the documented behavior, the expectation is that without session.readsession.read permission, you should only be able to retrieve your own sessions.

If you're able to read other users' sessions without having session.readsession.read permission, this may be unintended behavior worth reporting. I'd recommend clicking the "Ask for help" button to have a team member review this—they can confirm whether this is expected behavior or a potential issue that should be raised on GitHub.

For reference, the Get Session endpoint has similar permission logic—it allows access without session.readsession.read when the authenticated user requests their own session (checked user) . (1)

Ask Inkeep•12/10/25, 9:01 AM

To learn more, see the sources I considered:

[1] List sessions

Ask Inkeep•12/10/25, 9:01 AM

Feel free to tag @Ask Inkeep with additional questions.

AAsk Inkeep To learn more, see the sources I considered: [[1] List sessions](https://zita...

Ask InkeepAPP•12/10/25, 9:01 AM

Got it. Tagging @Rajat for additional help.

AngelOP•12/10/25, 9:17 AM

Furthermore, I still don't understand how I am supposed to revoke refresh tokens related to the session... I want my users to have a list of logged devices and be able to disconnect devices.

AngelOP•12/10/25, 9:29 AM

It's annoying, even when after deleteting all sessions of my user, refresh token still works

Rajat•12/10/25, 9:31 AM

hey @Angel I will take a look at it, allow me some time. Thanks

AAngel Hello, I am trying to list my own sessions with this endpoint https://zitadel.co...

Rajat•12/10/25, 9:56 AM

hey @Angel so I just tried your endpoint and it works for me, I think you need to check the permissions for the user who is making the call

RRajat hey <@177465439927009281> so I just tried your endpoint and it works for me, I t...

AngelOP•12/10/25, 10:41 AM

Yes I resolved it, I didn't have the scope

urn:zitadel:iam:org:project🆔zitadel:aud

urn:zitadel:iam:org:project🆔zitadel:aud

However, it shows every session even without scope session.read

AAngel Furthermore, I still don't understand how I am supposed to revoke refresh tokens...

AngelOP•12/10/25, 10:43 AM

and I also have issue here. How am I supposed to revoke my tokens if deleting a session only revoke access token

AAngel and I also have issue here. How am I supposed to revoke my tokens if deleting a ...

Rajat•12/10/25, 10:55 AM

I am not sure what have you tried already but you can use oauth/v2/revokeoauth/v2/revoke
When you revoke an

access_token

access_token

, only that specific access token is revoked.
When you revoke a refresh_tokenrefresh_token, the corresponding

access_token

access_token

is revoked as well.
You can read more about it How to revoke an Access Token/Refresh Token

How to revoke an Access Token/Refresh Token

This article explains how to revoke a user's access or refresh token

RRajat I am not sure what have you tried already but you can use `oauth/v2/revoke` When...

AngelOP•12/10/25, 11:08 AM

the problem is that a session can produce multiple tokens. If, for instance I want to use zitadel for sso. The log out won't work correctly

AAngel the problem is that a session can produce multiple tokens. If, for instance I wa...

Rajat•12/10/25, 11:30 AM

why do you think would the log out wont work correctly?. Unless I am getting something wrong?.

RRajat why do you think would the log out wont work correctly?. Unless I am getting som...

AngelOP•12/10/25, 12:08 PM

I mean, in the case of 2 apps that use sso. My user get one token per app. The decide to log out. The access token are revoked but the refresh token still works. The user can still use the apps while being logged out.

AngelOP•12/10/25, 12:10 PM

In the case of only 1 app. I just have to revoke the refresh token in the httponly cookie for instance

AngelOP•12/10/25, 12:11 PM

but when I have more apps, app1 don't know the refresh token the user have on app2

AngelOP•12/10/25, 12:22 PM

The only solution I see is to store the session with corresponding token. But it's not possible to get the current session related to the token.

AngelOP•12/10/25, 12:23 PM

So shouldn't zitadel add an option to revoke every refresh token instead of just access token in the delete session endpoint ?

AAngel So shouldn't zitadel add an option to revoke every refresh token instead of just...

Rajat•12/14/25, 8:38 AM

you can start a feature request for engineers to pitch in and discuss but you can also use.
The delete endpoint is meant to ONLY to terminate an existing session. it also invalidates the session and its token.
You can use revocation endpoint to to revoke a refresh_token, the corresponding access_token will be revoked as well

Rajat•12/15/25, 4:32 AM

Hey @Angel you can mark My answer with

and it'll auto close this thread.
Thank you