OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Authentication - Session Management

Get all sessions

  • Sandbox: available
  • Staging: available
  • Production: unknown
GET
/auth/session

Lists the caller's live sessions (one per sign-in). Use it to build a "where you are signed in" screen.

Auth: bearer token. Scope: the signed-in user's own sessions.

Behaviour

  • A session is listed when its Login belongs to the user, has a project membership and is not revoked. Sessions that have been idle for a long time are listed as long as they are not revoked.
  • The list is ordered newest first.
  • browser and os are null for sessions that Medplum does not report them for.
  • The call only reads. It does not change any session.

Example

curl -X GET 'https://api.sandbox.ovok.com/auth/session' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'

Authorization

bearer
headerAuthorizationBearer <JWT>

Response Body

application/json
  1. response
sessions*array<>
Example Request
curl -X GET 'https://api.sandbox.ovok.com/auth/session'
Example Response
{  "sessions": [    {      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",      "lastUpdated": "2019-08-24T14:15:22Z",      "authMethod": "string",      "remoteAddress": "string",      "browser": "string",      "os": "string"    }  ]}

Get account information GET

Returns the signed-in user's context: project, membership, profile, user configuration, access policy and security details such as MFA status and sessions. Call it after sign-in to learn who the token belongs to. **Auth:** bearer token. A missing, non-bearer or invalid token gives 401. **Scope:** the project of the token. ## Behaviour - The answer is Medplum's `auth/me` for the token's session. - The call always discards Ovok's cached copy of this session's profile and reads a fresh one, so changes to the profile or access policy show up in the response and in later requests with the same token. - Use the returned `profile.resourceType` to tell Patients from Practitioners. ## Example ```bash curl -X GET 'https://api.sandbox.ovok.com/auth/me' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```

Revoke sessions DELETE

Signs the caller out of one or more sessions. Use it for "sign out everywhere" and "sign out other devices" actions. **Auth:** bearer token. **Scope:** the signed-in user's own sessions. A session ID that is not one of the caller's sessions revokes nothing. ## Behaviour - `option` in the path is one of: - `current`: the session of the token you call with. - `other`: every session except the current one. - `all`: every session, including the current one. - a session ID (UUID) from `GET /auth/session`: that one session. - Ovok rejects the access tokens of the revoked sessions on their next request, and marks each Login as revoked in Medplum so the session cannot be renewed. - Revoking `current` or `all` also ends the token you called with. - The response echoes the revoked sessions with `revoked: true`: one object for `current` or a session ID, a list for `other` and `all`. - To end only the token you hold, without the session, use `POST /v1/auth/logout`. ## Example ```bash curl -X DELETE 'https://api.sandbox.ovok.com/auth/session/other' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```