BUILD

Sessions

Resolve, list, revoke, and sign out secure server-side sessions.

GET/api/auth/session/capabilities

Read session security status

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/auth/session/capabilities'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

public

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/auth/session

Resolve the current session

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/auth/session'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

browser session

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/auth/sessions

List active sessions

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/auth/sessions'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

browser session

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/auth/sessions/revoke

Revoke one owned session

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/auth/sessions/revoke'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + CSRF

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

Browser request

const response = await fetch("/api/auth/session", { credentials: "include" });
const session = await response.json();

Credential	Lifetime and handling
Regular Lucion session	12 hours; Secure, HttpOnly, host-only browser-session cookie and hash-only server-side lookup.
Remembered Lucion session	Fixed 30-day expiry selected at sign-in; matching Secure, HttpOnly, host-only persistent cookie.
OAuth access token	One hour.
OAuth refresh token	Rotates on use, expires within 30 days, and reuse revokes the token family.

Session expiry is fixed at sign-in and is not extended by activity. Password or passkey sign-in does not change the independent OAuth token lifetime.

Session lifecycle events are emitted as identity.session.revoked with only a session ID, user ID, and fixed non-secret reason. Session cookies and CSRF proofs are never included in webhook payloads.