openapi: 3.2.0
info:
  title: 'GTM API public contract: gtm.service.id Sessions API'
  description: 'Identity, access and money: users, teams and members, API keys, OAuth clients and authorizations, billing products, subscriptions, transactions and payment methods, notifications, TLS certificates and support requests.'
  version: '1.0'
  contact:
    name: GTM API
    url: https://gtm-api.com
    email: support@gtm-api.com
  license:
    name: Proprietary
    url: https://gtm-api.com/license
servers:
- url: https://app.gtm-api.com/id/v4
  description: Production, through the app.gtm-api.com gateway
security:
- BearerJwt: []
  TeamSid: []
tags:
- name: Sessions
  description: Registry package `mcp.id/sessions`, served on MCP mount `id.identity`.
paths:
  /api/sessions/search:
    post:
      operationId: search_sessions
      summary: Search sessions
      description: 'List sessions. Default scope is the caller''s own active sessions ("Active sessions"); pass kind:{eq:"oauth"} for "Connected agents", or status to see revoked/expired history. Each row carries the derived is_current flag (true for the caller''s own request) so "log out everywhere except this device" can skip it. Returns a counts block. page_size:0 returns counts only.


        Contract:

        - MCP tool `search_sessions`, registry package `mcp.id/sessions`, mount `id.identity`.

        - Operation `search`, response envelope `search`.

        - Flags: read only.'
      tags:
      - Sessions
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchSessionsRequest'
      responses:
        '200':
          description: '`search` success envelope.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchSessionsResponse'
        4XX:
          $ref: '#/components/responses/McpClientError'
        5XX:
          $ref: '#/components/responses/McpServerError'
      x-gtm-mcp-tool: search_sessions
      x-gtm-mcp-mount: id.identity
      x-gtm-entity: sessions
      x-gtm-operation: search
      x-gtm-envelope: search
      x-gtm-availability: ga
      x-gtm-dangerous: false
      x-gtm-mass-action: false
      x-gtm-step-eligible: false
      x-gtm-schedule-required: false
      x-gtm-tool-class: typical
  /api/sessions/{sid}/revoke:
    post:
      operationId: revoke_session
      summary: Revoke session
      description: 'End a session immediately: status active → revoked. The token is rejected from the next request (verifier cache flushed within 30-60s). This is the canonical "delete" for this entity; there is no delete tool. Idempotent: revoking an already revoked/expired session returns the row with result.already_revoked:true.


        Contract:

        - MCP tool `revoke_session`, registry package `mcp.id/sessions`, mount `id.identity`.

        - Operation `action`, response envelope `action`.

        - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.'
      tags:
      - Sessions
      parameters:
      - name: sid
        in: path
        required: true
        description: Session sid (id_se_…).
        schema:
          type: string
          minLength: 18
          maxLength: 18
          pattern: ^id_se_
          description: Session sid (id_se_…).
      responses:
        '200':
          description: '`action` success envelope.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RevokeSessionResponse'
        4XX:
          $ref: '#/components/responses/McpClientError'
        5XX:
          $ref: '#/components/responses/McpServerError'
      x-gtm-mcp-tool: revoke_session
      x-gtm-mcp-mount: id.identity
      x-gtm-entity: sessions
      x-gtm-operation: action
      x-gtm-envelope: action
      x-gtm-availability: ga
      x-gtm-dangerous: true
      x-gtm-mass-action: false
      x-gtm-step-eligible: false
      x-gtm-schedule-required: false
      x-gtm-tool-class: typical
components:
  schemas:
    SearchSessionsResponse:
      type: object
      properties:
        success:
          type: boolean
          enum:
          - true
        operation:
          type: string
          enum:
          - search
        items:
          type: array
          items:
            type: object
            properties:
              item:
                type: object
                properties:
                  sid:
                    type: string
                  team_sid:
                    type: string
                  user_sid:
                    type: string
                  status:
                    type: string
                    enum:
                    - active
                    - revoked
                    - expired
                  kind:
                    type: string
                    enum:
                    - login
                    - oauth
                  oauth_client_sid:
                    type:
                    - string
                    - 'null'
                  oauth_authorization_sid:
                    type:
                    - string
                    - 'null'
                  device:
                    type:
                    - string
                    - 'null'
                  ip_hash:
                    type:
                    - string
                    - 'null'
                  last_active_at:
                    type: string
                  expires_at:
                    type: string
                  created_at:
                    type: string
                  updated_at:
                    type: string
                  is_current:
                    type: boolean
                required:
                - sid
                - team_sid
                - user_sid
                - status
                - kind
                - oauth_client_sid
                - oauth_authorization_sid
                - device
                - ip_hash
                - last_active_at
                - expires_at
                - created_at
                - updated_at
                - is_current
              included:
                type: object
                additionalProperties: {}
            required:
            - item
            - included
        pagination:
          type: object
          properties:
            next_cursor:
              type:
              - string
              - 'null'
            has_more:
              type: boolean
            total_count:
              type:
              - integer
              - 'null'
          required:
          - next_cursor
          - has_more
          - total_count
        applied_filters:
          type: object
          additionalProperties: {}
        includes:
          type: array
          items:
            type: string
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type:
              - string
              - 'null'
              description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
            actor_type:
              type:
              - string
              - 'null'
              description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
          required:
          - trace_id
          - span_id
          - timestamp
          - duration_ms
        counts:
          type: object
          properties:
            total_count:
              type: number
            groups:
              type: object
              additionalProperties: {}
          required:
          - total_count
          - groups
      required:
      - success
      - operation
      - items
      - pagination
      - applied_filters
      - includes
      - meta
    McpError:
      type: object
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          type: object
          properties:
            code:
              type: string
              enum:
              - validation_failed
              - nothing_to_update
              - not_found
              - relation_not_found
              - invalid_transition
              - limit_exceeded
              - payment_required
              - duplicate_rejected
              - conflict
              - delete_blocked
              - unauthorized
              - forbidden
              - rate_limited
              - internal_error
              - service_unavailable
              - not_implemented
            message:
              type: string
            recoverable:
              type: boolean
            suggestion:
              type: string
            field_errors:
              type: object
              additionalProperties:
                type: array
                items:
                  type: object
                  properties:
                    rule:
                      type: string
                    message:
                      type: string
                  required:
                  - rule
                  - message
            blockers:
              type: array
              items:
                type: object
                properties:
                  type:
                    type: string
                    description: Machine-readable blocker type (active_flow, pending_tasks, …).
                  severity:
                    type: string
                    enum:
                    - hard
                    - soft
                    description: hard = external action required; soft = acknowledge is enough.
                  description:
                    type: string
                  entity_sid:
                    type:
                    - string
                    - 'null'
                  count:
                    type: integer
                  resolution:
                    type: string
                    description: 'Hard: tool name to call. Soft: code for acknowledge[].'
                  resolution_hint:
                    type: string
                required:
                - type
                - severity
                - description
                - entity_sid
                - resolution
                - resolution_hint
            context:
              type: object
              additionalProperties: {}
          required:
          - code
          - message
          - recoverable
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type:
              - string
              - 'null'
              description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
            actor_type:
              type:
              - string
              - 'null'
              description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
          required:
          - trace_id
          - span_id
          - timestamp
          - duration_ms
      required:
      - success
      - error
    RevokeSessionResponse:
      type: object
      properties:
        success:
          type: boolean
          enum:
          - true
        operation:
          type: string
          enum:
          - action
        action:
          type: string
          description: kebab-case verb; matches the route segment.
        item:
          type:
          - object
          - 'null'
          properties:
            sid:
              type: string
            team_sid:
              type: string
            user_sid:
              type: string
            status:
              type: string
              enum:
              - active
              - revoked
              - expired
            kind:
              type: string
              enum:
              - login
              - oauth
            oauth_client_sid:
              type:
              - string
              - 'null'
            oauth_authorization_sid:
              type:
              - string
              - 'null'
            device:
              type:
              - string
              - 'null'
            ip_hash:
              type:
              - string
              - 'null'
            last_active_at:
              type: string
            expires_at:
              type: string
            created_at:
              type: string
            updated_at:
              type: string
            is_current:
              type: boolean
          required:
          - sid
          - team_sid
          - user_sid
          - status
          - kind
          - oauth_client_sid
          - oauth_authorization_sid
          - device
          - ip_hash
          - last_active_at
          - expires_at
          - created_at
          - updated_at
          - is_current
        result:
          type: object
          properties:
            already_revoked:
              type: boolean
            revoked_at:
              type:
              - string
              - 'null'
          required:
          - already_revoked
          - revoked_at
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type:
              - string
              - 'null'
              description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
            actor_type:
              type:
              - string
              - 'null'
              description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
          required:
          - trace_id
          - span_id
          - timestamp
          - duration_ms
      required:
      - success
      - operation
      - action
      - item
      - result
      - meta
    SearchSessionsRequest:
      type: object
      description: Request body of `search_sessions`.
      properties:
        filter:
          type: object
          properties:
            sid:
              type: object
              properties:
                eq:
                  type: string
                in:
                  type: array
                  items:
                    type: string
              additionalProperties: false
            user_sid:
              type: object
              properties:
                eq:
                  type: string
                in:
                  type: array
                  items:
                    type: string
              additionalProperties: false
              description: Own sessions by default; other users require admin (sessions.view).
            team_sid:
              type: object
              properties:
                eq:
                  type: string
                in:
                  type: array
                  items:
                    type: string
              additionalProperties: false
            status:
              type: object
              properties:
                eq:
                  type: string
                  enum:
                  - active
                  - revoked
                  - expired
                ne:
                  type: string
                  enum:
                  - active
                  - revoked
                  - expired
                in:
                  type: array
                  items:
                    type: string
                    enum:
                    - active
                    - revoked
                    - expired
                nin:
                  type: array
                  items:
                    type: string
                    enum:
                    - active
                    - revoked
                    - expired
              additionalProperties: false
              description: 'Default scope = { eq: "active" }; pass explicitly for revoked/expired history.'
            kind:
              type: object
              properties:
                eq:
                  type: string
                  enum:
                  - login
                  - oauth
                in:
                  type: array
                  items:
                    type: string
                    enum:
                    - login
                    - oauth
              additionalProperties: false
              description: kind:{eq:"oauth"} = "Connected agents".
            oauth_client_sid:
              type: object
              properties:
                eq:
                  type: string
                in:
                  type: array
                  items:
                    type: string
                is_null:
                  type: boolean
              additionalProperties: false
              description: is_null:true = login sessions only.
            last_active_at:
              type: object
              properties:
                gte:
                  type: string
                lte:
                  type: string
                gt:
                  type: string
                lt:
                  type: string
              additionalProperties: false
            expires_at:
              type: object
              properties:
                gte:
                  type: string
                lte:
                  type: string
                gt:
                  type: string
                lt:
                  type: string
              additionalProperties: false
            created_at:
              type: object
              properties:
                gte:
                  type: string
                lte:
                  type: string
                gt:
                  type: string
                lt:
                  type: string
              additionalProperties: false
        sort:
          type: object
          properties:
            field:
              type: string
              enum:
              - last_active_at
              - created_at
              - expires_at
            direction:
              type: string
              enum:
              - asc
              - desc
              description: Default desc.
          required:
          - field
        page_size:
          type: integer
          minimum: 0
          maximum: 500
          description: 0..500, default 50. page_size=0 = count-only, page_size=1 = getFirst.
        cursor:
          type:
          - string
          - 'null'
          description: Opaque forward cursor from a previous response pagination.next_cursor.
  responses:
    McpServerError:
      description: MCP error envelope with `error.code` internal_error or service_unavailable.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/McpError'
    McpClientError:
      description: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/McpError'
  securitySchemes:
    BearerJwt:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Access token issued by gtm.service.id. Its `access_identity` claim carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is authoritative.
    TeamSid:
      type: apiKey
      in: header
      name: Team-SID
      description: Team scope for tokens that do not carry one. Ignored when the token already names a team.