Get authorized clients
GET https://z.u1v.ru/api/v1/users/me/authorized_clients
Get the list of authorized clients for the current user. Authorized
clients are browser sessions and revocable API-client credentials that
can access the user's account.
This endpoint is separate from
POST /register_client_device and
POST /remove_client_device, which manage
push-notification device registrations and do not revoke authorization.
The synthetic legacy_api_key entry represents clients that still use
the user's global API key. It is not individually revocable; use
POST /users/me/api_key/regenerate to
broadly invalidate legacy API-key access.
The public API contract for this feature is authorized_clients;
/api/v1/sessions is intentionally not provided.
Changes: New in Zulip 12.0 (feature level 499).
Usage examples
The -u line implements HTTP Basic authentication.
See the Authorization header documentation for how
to get those credentials for Zulip users and bots.
curl -sSX GET -G https://z.u1v.ru/api/v1/users/me/authorized_clients \
-u EMAIL_ADDRESS:API_KEY
Parameters
This endpoint does not accept any parameters.
Response
Return values
-
clients: (object)[]
The current user's active authorized clients.
-
id: string
An opaque public identifier for this authorized
client. This is not a Django session key, API
token, token hash, or database ID.
-
type: string
The kind of authorized access represented by
this client.
-
current: boolean
Whether this entry is the client used for the
current request.
-
revocable: boolean
Whether this client can be revoked with
DELETE /users/me/authorized_clients/{client_id}.
The current client and legacy API-key entry are
not individually revocable.
-
client_name: string
Display name for the client application.
-
device_name: string | null
Best-effort display name for the device, if
known.
-
device_kind: string | null
Best-effort device category, such as desktop
or mobile, if known.
-
created_at: integer | null
When this authorized client was created, as a
Unix timestamp. The legacy API-key entry uses
null.
-
last_seen: integer | null
When this authorized client was last observed,
as a Unix timestamp. This value is throttled
and should not be used as fresh-auth proof.
-
expires_at: integer | null
When this client expires, as a Unix timestamp,
or null if no explicit expiration is known.
-
ip_address: string | null
Optional display-only IP metadata. Clients must
not treat it as a security boundary.
-
user_agent: string | null
Optional display-only user-agent metadata,
truncated by the server.
-
actions: (string)[]
Actions the user interface can offer for this
client.
-
can_terminate_other_clients: boolean
Whether the user can terminate other authorized
clients from this account.
-
legacy_api_key_clients_present: boolean
Whether the response includes the synthetic legacy
API-key compatibility entry.
Example response(s)
Changes: As of Zulip 7.0 (feature level 167), if any
parameters sent in the request are not supported by this
endpoint, a successful JSON response will include an
ignored_parameters_unsupported array.
A typical successful JSON response may look like:
{
"can_terminate_other_clients": true,
"clients": [
{
"actions": [],
"client_name": "Zulip web",
"created_at": 1780507200,
"current": true,
"device_kind": null,
"device_name": null,
"expires_at": 1781716800,
"id": "ac_6pQk2rYv",
"ip_address": "203.0.113.42",
"last_seen": 1780509000,
"revocable": false,
"type": "web_session",
"user_agent": "Mozilla/5.0"
},
{
"actions": [
"regenerate_api_key"
],
"client_name": "Legacy API key clients",
"created_at": null,
"current": false,
"device_kind": null,
"device_name": null,
"expires_at": null,
"id": "legacy_api_key",
"ip_address": null,
"last_seen": null,
"revocable": false,
"type": "legacy_api_key",
"user_agent": null
}
],
"legacy_api_key_clients_present": true,
"msg": "",
"result": "success"
}