ZB

Sessions

Sessions track active authentication contexts for a user across devices and channels. Users can view their active sessions, revoke individual sessions, or log out from all sessions at once for security purposes.

The session model

The session model represents an active authentication context. Each time a user logs in, a new session is created and associated with metadata about the device and network.

Properties

  • Name
    id
    Type
    string (UUID)
    Description

    Unique identifier for the session.

  • Name
    channel
    Type
    string
    Description

    The channel through which the session was created (e.g., web, mobile, api).

  • Name
    ipAddress
    Type
    string
    Description

    The IP address from which the session was initiated.

  • Name
    userAgent
    Type
    string
    Description

    The User-Agent string of the client that created the session.

  • Name
    createdAt
    Type
    string (ISO 8601)
    Description

    Timestamp of when the session was created.

  • Name
    expiresAt
    Type
    string (ISO 8601)
    Description

    Timestamp of when the session will automatically expire.

  • Name
    isActive
    Type
    boolean
    Description

    Whether the session is currently active. A session becomes inactive when it is revoked or expires.

Session object

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "channel": "web",
  "ipAddress": "197.221.45.120",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
  "createdAt": "2026-05-31T08:00:00Z",
  "expiresAt": "2026-06-30T08:00:00Z",
  "isActive": true
}

Sessions are automatically cleaned up after they expire. The isActive field reflects whether the session can still be used for authentication. Revoking a session sets isActive to false immediately.

GET/sessions

List active sessions

Retrieve all active sessions for the currently authenticated user. This allows users to see where their account is logged in and identify any sessions they do not recognize.

Request

GET
/sessions
curl https://id.zb.co.zw/sessions \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..."

Response

[
  {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "channel": "web",
    "ipAddress": "197.221.45.120",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
    "createdAt": "2026-05-31T08:00:00Z",
    "expiresAt": "2026-06-30T08:00:00Z",
    "isActive": true
  },
  {
    "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
    "channel": "mobile",
    "ipAddress": "41.60.12.88",
    "userAgent": "ZBIDApp/2.1.0 (Android 14; Pixel 8)",
    "createdAt": "2026-05-28T14:22:00Z",
    "expiresAt": "2026-06-27T14:22:00Z",
    "isActive": true
  }
]
GET/sessionsTry it

List your active sessions

Uses the token from your last sign-in. Returns the active sessions for the signed-in identity, including the one created by your Try it login. With no token it returns 401.

Runs against the ZB ID STAGING sandbox (id-staging.zb.co.zw). Register a throwaway test account; never use real credentials.

No token yet. Sign in above, or paste one below.
Query parameters
DELETE/sessions/{id}

Revoke a session

Revoke a specific session by its ID. This immediately invalidates the session, preventing any further authenticated requests using the token associated with that session.

Use this to log out a single device without affecting other active sessions.

Request

DELETE
/sessions/{id}
curl -X DELETE https://id.zb.co.zw/sessions/b2c3d4e5-f6a7-8901-bcde-f12345678901 \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..."

Response

{
  "result": "success",
  "message": "Session revoked"
}
POST/auth/logout

Logout current session

Log out the current session. This blacklists the Bearer token used in the request and revokes the associated session. After calling this endpoint, the token can no longer be used for authentication.

This endpoint accepts no request body. The session to revoke is determined by the Bearer token provided in the Authorization header.

Request

POST
/auth/logout
curl -X POST https://id.zb.co.zw/auth/logout \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..."

Response

{
  "result": "success",
  "message": "Logged out successfully"
}

After logging out, you must discard the token on the client side. Any subsequent requests using the blacklisted token will receive a 401 Unauthorized response.

POST/auth/logout/all

Logout all sessions

Log out from all active sessions. This revokes every session associated with the current user and blacklists all issued tokens. Use this when a user suspects their account has been compromised or wants to sign out from all devices at once.

This endpoint accepts no request body.

Request

POST
/auth/logout/all
curl -X POST https://id.zb.co.zw/auth/logout/all \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..."

Response

{
  "result": "success",
  "message": "All sessions revoked"
}

This action cannot be undone. The user (and all their devices) will need to authenticate again after this call. The token used to make this request is also invalidated.

Was this page helpful?