Translation. Original: auth/sesje.md

Authentication Session Management

10.07.2025

Retrieving List of Active Authentication Sessions

Returns a list of active authentication sessions.

GET /auth/sessions

Example in C#: KSeF.Client.Tests.Core/E2E/Authorization/Sessions/SessionE2ETests.cs

const int pageSize = 20;
string continuationToken = string.Empty;
List<AuthenticationListItem> authenticationListItems = [];

do
{
    AuthenticationListResponse page = await ActiveSessionsClient.GetActiveSessions(accessToken, pageSize, continuationToken, CancellationToken.None);
    continuationToken = page.ContinuationToken;
    if (page.Items != null)
    {
        authenticationListItems.AddRange(page.Items);
    }
}
while (!string.IsNullOrWhiteSpace(continuationToken));

Example in Java: SessionIntegrationTest.java

int pageSize = 10;
AuthenticationListResponse activeSessions = createKSeFClient().getActiveSessions(10, null, accessToken);
while (Strings.isNotBlank(activeSessions.getContinuationToken())) {
    activeSessions = createKSeFClient().getActiveSessions(10, activeSessions.getContinuationToken(), accessToken);
}

Revoking Current Session

DELETE /auth/sessions/current

Revokes the session associated with the token used to call this endpoint. After the operation:

• the associated refreshToken is revoked,
• active accessTokens remain valid until their expiration time.

Example in C#: KSeF.Client.Tests.Core/E2E/Authorization/Sessions/SessionE2ETests.cs

await ksefClient.RevokeCurrentSessionAsync(token, cancellationToken);

Example in Java: SessionIntegrationTest.java

createKSeFClient().revokeCurrentSession(accessToken);

Revoking Selected Session

DELETE /auth/sessions/{referenceNumber}

Revokes the session with the specified reference number. After the operation:

• the associated refreshToken is revoked,
• active accessTokens remain valid until their expiration time.

Example in C#: KSeF.Client.Tests.Core/E2E/Authorization/Sessions/SessionE2ETests.cs

await ksefClient.RevokeSessionAsync(referenceNumber, accessToken, cancellationToken);

Example in Java: SessionIntegrationTest.java

createKSeFClient().revokeSession(secondSessionReferenceNumber, firstAccessTokensPair.accessToken());