> ## Documentation Index > Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt > Use this file to discover all available pages before exploring further. # List STS sessions > List active and recent STS (role assumption) sessions for the current organization. Requires `iam:ListSTSSessions` permission. ## OpenAPI ````yaml /api-reference/specs/iam.yaml get /v1/sts-sessions openapi: 3.0.3 info: title: Basaltic IAM API version: 1.0.0 description: | Identity for the platform: organizations, accounts, users, groups, service accounts, roles and policies, together with the sign-in flows and the temporary STS credentials every other Basaltic API authenticates against. contact: name: Basaltic Support email: ping@basaltic.sh license: name: Proprietary url: https://basaltic.sh/terms servers: - url: https://iam.basaltic.sh description: Global API endpoint security: - SignatureAuth: [] paths: /v1/sts-sessions: get: tags: - IAM summary: List STS sessions description: > List active and recent STS (role assumption) sessions for the current organization. Requires `iam:ListSTSSessions` permission. operationId: listSTSSessions parameters: - name: role_id in: query description: Filter by role ID schema: type: string format: uuid example: b2c3d4e5-f6a7-8901-2345-67890abcdef1 - name: principal_id in: query description: Filter by principal ID (user or service account) schema: type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 - name: principal_type in: query description: | Filter by principal type. `assumed_role` selects the sessions role chaining produces, where an existing assumed-role session assumed another role. schema: type: string enum: - user - service_account - assumed_role example: service_account - name: active_only in: query description: Only show active (non-expired, non-revoked) sessions schema: type: boolean default: true example: true - $ref: '#/components/parameters/Limit' - $ref: '#/components/parameters/Marker' responses: '200': description: List of STS sessions content: application/json: schema: $ref: '#/components/schemas/STSSessionListResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' components: parameters: Limit: name: limit in: query description: >- Maximum number of items to return. A value above the maximum is clamped to it rather than rejected, so a page shorter than the one you asked for is normal — page until `meta.has_more` is false, not until a page looks short. required: false schema: type: integer minimum: 1 maximum: 100 default: 20 example: 20 Marker: name: marker in: query description: >- Opaque pagination cursor. Echo back the `meta.marker` value from the previous page to fetch the next one; do not construct or parse it. The token's internal form varies by endpoint (a resource ID, a timestamp, …) and is not guaranteed stable across releases. required: false schema: type: string example: 550e8400-e29b-41d4-a716-446655440000 schemas: STSSessionListResponse: type: object properties: sts_sessions: type: array items: $ref: '#/components/schemas/STSSession' meta: $ref: '#/components/schemas/PaginationMeta' STSSession: type: object description: | A set of temporary credentials, as returned by the STS session listing. There is no "active" flag — a session is usable while `revoked` is false and `expires_at` is in the future. properties: id: type: string format: uuid readOnly: true example: f6a7b8c9-d0e1-2345-6789-0abcdef12345 role_id: type: string description: | The role being assumed. Empty on a session minted by `POST /v1/session-token`, which is bound to the user directly and assumes no role. example: b2c3d4e5-f6a7-8901-2345-67890abcdef1 principal_id: type: string format: uuid description: ID of the principal assuming the role (the source identity) example: 550e8400-e29b-41d4-a716-446655440000 principal_type: type: string enum: - user - service_account - assumed_role example: service_account session_name: type: string nullable: true description: Optional session identifier example: deploy-session created_at: type: string format: date-time example: '2026-01-15T09:30:00Z' expires_at: type: string format: date-time example: '2026-01-15T10:30:00Z' last_used_at: type: string format: date-time nullable: true example: '2026-01-15T09:45:00Z' revoked: type: boolean description: Whether the session has been revoked example: false revoked_at: type: string format: date-time nullable: true example: '2026-01-15T10:00:00Z' revoked_reason: type: string nullable: true example: Security incident response source_ip: type: string nullable: true description: IP address where the session was created example: 203.0.113.42 user_agent: type: string nullable: true description: User-Agent of the caller that created the session example: basaltic-cli/1.4.0 PaginationMeta: type: object properties: total: type: integer description: Total number of items example: 150 limit: type: integer description: Number of items per page example: 20 marker: type: string description: >- Opaque cursor for the next page. Pass it back as the `marker` query parameter; treat it as a token, not a value to parse. example: 550e8400-e29b-41d4-a716-446655440000 has_more: type: boolean description: Whether there are more items example: true Error: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string description: Error code identifying the type of error example: INVALID_INPUT message: type: string description: Human-readable error message example: Invalid request parameters request_id: type: string format: uuid description: Request ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 responses: Unauthorized: description: Authentication required or token invalid content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: UNAUTHORIZED message: Authentication required request_id: 550e8400-e29b-41d4-a716-446655440000 Forbidden: description: Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ACCESS_DENIED message: You don't have permission to perform this action request_id: 550e8400-e29b-41d4-a716-446655440000 securitySchemes: SignatureAuth: type: apiKey in: header name: Authorization description: > Request signing with an access key issued to a service account. An HMAC-SHA256 over a canonical form of the request, close to AWS SigV4. The `basaltic` CLI signs for you. Send `Authorization`, `X-Date` (UTC, `YYYYMMDDTHHMMSSZ`) and `X-Nonce` (random per request); add `X-Content-Sha256` to bind a body, and `X-Amz-Security-Token` when using temporary credentials. ``` Authorization: BASALTIC-HMAC-SHA256 Credential=///basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature= ``` `` is the region code you are calling, or `global` for the global services. A signature is valid for 5 minutes from `X-Date`, and mutating requests are replay-guarded on the nonce. **Full signing procedure, including a working implementation:** https://docs.basaltic.sh/authentication ## Rate limits There is no global request budget. A limit applies only where an operation documents a `429`, and that operation says what it counts. Those responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and, on a `429`, `Retry-After` — read them rather than hard-coding a number. Retrying before `Retry-After` is refused and extends the window. Everything else is bounded by quota, not by request rate. ````