List Active Sessions
GET /v1/access/users/{user_id}/sessions
Returns all active sessions for a user.
Revoke a Session
DELETE /v1/access/sessions/{session_id}
Immediately invalidates the session token. The user will be required to log in again.
Response — 204 No Content
Revoke All Sessions for a User
POST /v1/access/users/{user_id}/sessions/revoke-all
Logs the user out of all active sessions across all devices. Useful when a credential compromise is suspected.
Response — 200 OK
Check MFA Status
GET /v1/access/users/{user_id}/mfa
Enforce MFA for a Workspace
Require MFA for all users at the workspace level:
PATCH /v1/access/settings
Users who have not enrolled MFA will be prompted on their next login and must enrol within the grace period before losing access.
Enforcing MFA with a short grace period may lock out users who do not act quickly. Communicate the change to your team before enabling.