BizKitHub
DocsAPI ReferenceAccount/bff/account/active-sessions
getAccountAdmin BFF

/bff/account/active-sessions

Returns every authorised shop__contact_login_identity row for the current user — browser sessions and AI-agent credentials both. API keys are excluded (external-integration credentials owned by the organisation, not personal seats). Powers the settings > security > active sessions grid; the currentSessionId field identifies which row belongs to the calling browser.

AccountgetBffAccountActive-sessions

Parameters

No parameters required

This endpoint takes no path, query, header or body parameters.

Response schema

1 status code documented

200Success
itemCountnumberRequired

Total number of active sessions returned.

currentSessionIdnumber | nullRequired

Internal id of the row backing the caller's current session, or null when the caller is not authenticated by a cookie.

One of 2:
Variant 1
number
Variant 2
null
itemsobject[]Required
Each array item:
idnumberRequired

Internal id of the shop__contact_login_identity row (the only wire handle for logout).

kind"human" | "ai_agent"Required

Browser session vs. AI-agent credential provisioned via /bff/ai-agent/provision.

agentChildCountnumberRequired

Count of active AI-agent rows whose parent_identity_id points at this session. Always 0 for ai_agent rows themselves.

Range: 0–∞
insertedDatestringRequired

ISO datetime when the session was created (login or provisioning).

expirationDatestringRequired

ISO datetime when the session will expire on its own (~3 months for humans, 30 days for agents).

lastActivityDatestring | nullRequired

ISO datetime of the last request that used this identity, or null if never used.

One of 2:
Variant 1
string
Variant 2
null
devicestring | nullRequired

Parsed device label from the User-Agent, if available.

One of 2:
Variant 1
string
Variant 2
null
userAgentstring | nullRequired

Raw User-Agent header captured at creation.

One of 2:
Variant 1
string
Variant 2
null
ipstringRequired

Accepted formats:

  • IPv4 dot-decimal, e.g. 1.1.1.1 (4 octets, 0–255, no leading zeros).
  • IPv6 as defined by RFC 4291 — full 2001:0db8:0000:0000:0000:0000:0000:0001, zero-compressed 2001:db8::1, IPv4-mapped ::ffff:1.2.3.4, or scoped literals. Both upper- and lower-case hex are accepted.

Server-side canonicalization (ipNormalize in core/src/lib/network/ipNormalize.ts):

  • Valid IPv4 is passed through verbatim.
  • Valid IPv6 is lowercased (RFC 5952 §4.3).
  • IPv4-mapped IPv6 ::ffff:X.X.X.X is unwrapped to plain IPv4 (RFC 4291 §2.5.5.2) so 1.2.3.4 and ::ffff:1.2.3.4 share one brj__geo_ip row.
  • Loopback aliases (::1, 0.0.0.0, localhost, empty string) collapse to 127.0.0.1.
  • Junk values that fail both IPv4 and IPv6 validation are silently rejected and replaced with 127.0.0.1 (loopback).

On the wire: every response returns the canonicalized form — clients can safely rely on lowercase IPv6 and the plain-IPv4 unwrap when de-duping or joining. Server-originated writers (activity log, session log, ban list) resolve the visitor IP via resolveClientIp / resolveClientIpOrNull — always native IPv6 on Vercel Edge (there is no auto-mapping to ::ffff:X.X.X.X).

Enrichment: the system resolves reverse DNS, geolocation, ASN, mobile/proxy/hosting/Tor flags via our VikiTron GEO/IP resolver for both address families. Learn more

Examples1.1.1.12001:4860:4860::8888
hostnamestring | nullRequired

Reverse-DNS hostname of the IP.

One of 2:
Variant 1
string
Variant 2
null
citystring | nullRequired

City resolved from GeoIP.

One of 2:
Variant 1
string
Variant 2
null
countrystring | nullRequired

ISO country code resolved from GeoIP.

One of 2:
Variant 1
string
Variant 2
null
countryRegionstring | nullRequired

Region/state resolved from GeoIP.

One of 2:
Variant 1
string
Variant 2
null
asnstring | nullRequired

ASN of the network owning the IP.

One of 2:
Variant 1
string
Variant 2
null
asnOrganizationstring | nullRequired

ASN owner organisation name.

One of 2:
Variant 1
string
Variant 2
null
ispstring | nullRequired

ISP name from the GeoIP database.

One of 2:
Variant 1
string
Variant 2
null
mobilebooleanRequired

True if the IP belongs to a mobile carrier.

proxybooleanRequired

True if the IP is a known anonymising proxy.

hostingbooleanRequired

True if the IP belongs to a hosting/cloud provider.

torbooleanRequired

True if the IP is a known Tor exit node.

Response example

application/json
{
  "itemCount": 0,
  "items": [
    {
      "id": 0,
      "agentChildCount": 0,
      "insertedDate": "example_insertedDate",
      "expirationDate": "example_expirationDate",
      "ip": "1.1.1.1",
      "mobile": false,
      "proxy": false,
      "hosting": false,
      "tor": false
    }
  ]
}

Request example

GET /bff/account/active-sessions

get
curl -X GET "https://api.bizkithub.com/bff/account/active-sessions" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY"

Need an API key?

All BizKitHub public API endpoints require authentication via API key.

Get API Key