Contents
On this page

List Sessions - Plugixa Activity Log

GET /plugixa-activity-log/v1/sessions

List the WordPress sign-in sessions that have not expired yet, newest sign-in first.

Any signed-in account may call it, whatever its role. With settings access you see everybody’s sessions and can filter them; anyone else sees only their own (see who can call what). Needs Plugixa Activity Log Pro, with the User sessions module on under Plugixa Activity Log -> Monitors.

Note. Without settings access the query parameters are ignored, not refused: the answer is always your own sessions. meta.everyone tells you which view you got.

Request

GET https://your-site.example/wp-json/plugixa-activity-log/v1/sessions?role=administrator

Query parameters

These apply only to callers with settings access.

Name Type Default Description
user_id integer Sessions of this user only.
role string Users with this role on the current site.
search string Users whose login, display name or email address contains the term.

The list is not paged. It covers at most 2,000 users who hold sessions.

Responses

200 OK. data is every live session; meta counts them.

{
  "success": true,
  "data": [
    {
      "id": "1:3f9a1c0e7b2d4a6f8e5c9b1d0a2f4e6c8b7a9d1e3f5c7b9a0d2e4f6a8c1b3d5e",
      "verifier": "3f9a1c0e7b2d4a6f8e5c9b1d0a2f4e6c8b7a9d1e3f5c7b9a0d2e4f6a8c1b3d5e",
      "user_id": 1,
      "login": "alex",
      "name": "Alex Martin",
      "initial": "A",
      "role": "administrator",
      "roles": ["administrator"],
      "ip": "203.0.113.9",
      "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36",
      "browser": "Chrome on Windows",
      "login_at": 1762934400,
      "last_seen": 1762939800,
      "expires_at": 1763107200,
      "current": false
    }
  ],
  "meta": { "sessions": 1, "people": 1, "everyone": true }
}
Field Type Meaning
data[].id string The user id and the verifier, joined by :
data[].verifier string The session’s identifier, 64 hexadecimal characters. Use it with End Session
data[].user_id integer WordPress user id
data[].login string The user’s login
data[].name string Display name, or the login when there is none
data[].role string The user’s first role, or empty
data[].roles string[] Every role the user has
data[].ip string The address the session signed in from
data[].user_agent string The browser’s User-Agent, at most 255 characters
data[].browser string A readable label such as Chrome on Windows, or Unknown browser
data[].login_at integer Unix timestamp of the sign-in
data[].last_seen integer|null Unix timestamp of the last activity seen, or null
data[].expires_at integer Unix timestamp when the session expires
data[].current boolean true for the browser session making this request. Always false over Application Passwords, which have no session
meta.sessions integer Sessions in data
meta.people integer Distinct users in data
meta.everyone boolean true when you were shown everybody’s sessions

Errors

Status Code When
401 rest_forbidden Nobody is signed in. This route answers with WordPress’s own code.

Plus the errors every endpoint can return.

Examples

curl -s "https://your-site.example/wp-json/plugixa-activity-log/v1/sessions?role=administrator" \
  -u "admin:$WP_APP_PASSWORD"

<?php
$query = http_build_query(['role' => 'administrator']);
$ch = curl_init('https://your-site.example/wp-json/plugixa-activity-log/v1/sessions?' . $query);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD        => 'admin:' . getenv('WP_APP_PASSWORD'),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

const auth = Buffer.from(`admin:${process.env.WP_APP_PASSWORD}`).toString('base64');
const query = new URLSearchParams({ role: 'administrator' });
const response = await fetch(`https://your-site.example/wp-json/plugixa-activity-log/v1/sessions?${query}`, {
  headers: {
    'Authorization': `Basic ${auth}`,
  },
});
const { data, meta } = await response.json();

Quick Links

Share