Read the current user session

GET

/v1/id/get-session

const url = 'https://your-tenant-host/v1/id/get-session';
const options = {
  method: 'GET',
  headers: {
    cookie: 'ek.session_token=<ek.session_token>',
    'x-edgekit-site-id': 'site_example'
  }
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://your-tenant-host/v1/id/get-session \
  --header 'x-edgekit-site-id: site_example' \
  --cookie ek.session_token=<ek.session_token>

Never cached. Mounted in all three idModes — the authority differs, not the surface, which is what lets an organization move external_only to dual without shipping an SDK release. No credential answers 200 with a null user and a null session, never 401. In dual it also performs the exchange on first sight and reports it as session.exchanged, which makes this a write — still safe to retry.

Authorizations

UserSession

Parameters

Header Parameters

x-edgekit-site-id

required

The site this request is for, within this tenant. Every official EdgeKit SDK sets it from the client you configured; set it yourself only when calling this API directly.

string

>= 1 characters <= 128 characters

Example

site_example

The site this request is for, within this tenant. Every official EdgeKit SDK sets it from the client you configured; set it yourself only when calling this API directly.

Responses

200

The user and their session, or two nulls.

application/json

object

user

required

object

required

string format: uuid

email

required

string

emailVerified

required

boolean

name

required

string | null

firstName

required

string | null

lastName

required

string | null

image

required

string | null

session

required

One of:

object

required

string format: uuid

kind

required

string

Allowed values: edgekit

expiresAt

required

string format: date-time

exchanged

boolean

Example

{
  "user": {
    "id": "01926f3a-8b4c-7d2e-9f10-2a3b4c5d6e7f",
    "email": "user@example.com",
    "emailVerified": true,
    "name": "Ada Lovelace",
    "firstName": "Ada",
    "lastName": "Lovelace",
    "image": null
  },
  "session": {
    "id": "01926f3a-8b4d-7a11-8c22-3d4e5f6a7b8c",
    "kind": "edgekit",
    "expiresAt": "2026-08-30T09:00:00.000Z",
    "exchanged": true
  }
}

400

Invalid request.

application/json

object

error

required

object

code

required

string

message

required

string

details

Example

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

403

Not allowed.

application/json

object

error

required

object

code

required

string

message

required

string

details

Example

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

404

Resource not found.

application/json

object

error

required

object

code

required

string

message

required

string

details

Example

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

422

Request validation failed.

application/json

object

error

required

object

code

required

string

message

required

string

details

Example

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

500

Unexpected error.

application/json

object

error

required

object

code

required

string

message

required

string

details

Example

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}