Skip to main content
GET
List STS sessions
Requires the IAM action iam:ListSTSSessions. See IAM permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Query Parameters

name
string

Exact resource name, combined with crn using AND before pagination. Empty values are filters. Resources without a name never match.

crn
string

Exact returned CRN, combined with name using AND before pagination. Malformed or empty CRNs return 400; valid mismatched or foreign CRNs return an empty page. Resources without a CRN never match. Organization-scoped CRNs use the authenticated organization.

role
string

Role UUID, immutable name, or account-qualified role CRN.

Example:

"b2c3d4e5-f6a7-8901-2345-67890abcdef1"

principal
string

Principal reference; principal_type is required. Users and assumed-role sessions accept UUID or CRN; roles and service accounts also accept names in the owning account.

Example:

"550e8400-e29b-41d4-a716-446655440000"

principal_type
enum<string>

Filter by principal type. assumed_role selects the sessions role chaining produces, where an existing assumed-role session assumed another role.

Available options:
user,
service_account,
role,
assumed_role
Example:

"service_account"

active_only
boolean
default:true

Only show active (non-expired, non-revoked) sessions

Example:

true

limit
integer
default:20

Maximum number of items to return. A value above the maximum is clamped to it rather than rejected, so a page shorter than the one you asked for is normal — page until meta.has_more is false, not until a page looks short.

Required range: 1 <= x <= 100
marker
string

Opaque pagination cursor. Echo back the meta.marker value from the previous page to fetch the next one; do not construct or parse it. The token's internal form varies by endpoint (a resource ID, a timestamp, …) and is not guaranteed stable across releases.

Response

List of STS sessions

sts_sessions
object[]
required
meta
object
required