Skip to main content
GET
Get the session
Authentication is new. These endpoints are served by your application’s issuer, such as https://<name>.auth.didit.me, and never take your Didit API key.
This is the instant revocation check. It allows 30 requests a minute and 300 an hour per IP address, so verify tokens offline on every request and call it before sensitive actions. See Check the session.

Authorizations

Authorization
string
header
required

The person's access token from POST /token/: an ES256 JWT with header typ: at+jwt, valid for at most 5 minutes. Not your Didit API key.

Response

The session is live.

The live session behind an access token.

sub
string<uuid>
required

The identity ID.

Example:

"1c9d8b88-1bff-43d1-ad7a-88b2bc0024e9"

sid
string<uuid>
required

The session ID.

Example:

"c9abf6cc-2d64-4bf2-b31e-a4d09a070ab1"

application_id
string<uuid>
required
Example:

"7b0a6c2e-3f41-4c9a-8d55-1e2f3a4b5c6d"

vendor_data
string
required

The person's reference across Didit products, as in the tokens.

Example:

"user-42"

amr
string[]
required

How the session signed in, as one value: for example password, code (email code), magic (magic link), passkey, phone, sso, wallet (Didit ID Wallet) or the name of a social sign-in method. Empty for an agent token.

Example:
mfa_verified
boolean
required

Whether the session passed a second factor. Always true for a passkey sign-in.

Example:

false

email
string<email> | null
required
Example:

"person@example.com"

email_verified
boolean
required
Example:

true

phone
string | null
required

E.164 phone number, or null.

Example:

null

verified_identity
object | null
required

What the Didit ID Wallet shared at sign-in. null when the person signed in another way.

verified
object | null
required

Verification level and selected claims, the same object the tokens carry as verified, or null when there is none. Read this, not email_verified, to know whether the person verified their identity.

expires_at
string<date-time>
required

When the session ends at the latest. Idle timeout can end it sooner.

Example:

"2026-11-16T10:41:14.347557Z"

post_logout_redirect_uri
string
required

Where your application sends the person after sign-out. Empty string when not set.

Example:

"https://app.example.com/"

organizations
object[]
required

Every customer organization the person belongs to, when organizations are on. Empty otherwise.