# Session

User session management

## Fetch Session information

`GET /session`

Authentication: no security requirement declared for this operation.

Parameters:

- `token` (query, string, optional)
  Type: string

Responses:

- 200: OK

Content type: application/json

Type: User

Schema: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md)

- `id` (optional)
  Type: integer, int64
  
  Unique user identifier

- `name` (optional)
  Type: string
  
  User display name

- `email` (optional)
  Type: string
  
  Email address used for login and notifications

- `phone` (optional)
  Type: string; nullable
  
  Contact phone number for alerts

- `readonly` (optional)
  Type: boolean
  
  When true, the user cannot change settings

- `administrator` (optional)
  Type: boolean
  
  Grants full administrative privileges when enabled

- `map` (optional)
  Type: string; nullable
  
  Preferred default map layer for the user

- `latitude` (optional)
  Type: number
  
  Default map center latitude for this user

- `longitude` (optional)
  Type: number
  
  Default map center longitude for this user

- `zoom` (optional)
  Type: integer
  
  Default map zoom level on login

- `password` (optional)
  Type: string
  
  Password for user authentication

- `coordinateFormat` (optional)
  Type: string; nullable
  
  Preferred coordinate display format

- `disabled` (optional)
  Type: boolean
  
  Indicates whether the user account is disabled

- `expirationTime` (optional)
  Type: string, date-time; nullable
  
  in ISO 8601 format. eg. `1963-11-22T18:30:00Z`

- `deviceLimit` (optional)
  Type: integer
  
  Maximum number of devices the user can manage

- `userLimit` (optional)
  Type: integer
  
  Maximum number of subordinate users

- `deviceReadonly` (optional)
  Type: boolean
  
  Restricts user from modifying device attributes

- `limitCommands` (optional)
  Type: boolean
  
  Prevents user from sending unsupported commands

- `fixedEmail` (optional)
  Type: boolean
  
  Locks the email field to avoid changes

- `poiLayer` (optional)
  Type: string; nullable
  
  External POI layer configured for the user

- `attributes` (optional)
  Type: object
  
  Additional custom user attributes

- 404: Not found

## Examples

### cURL

```bash
curl -X GET 'https://demo.traccar.org/api/session'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/session', {
  method: 'GET',
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.get('https://demo.traccar.org/api/session')
print(response.text)
```


## Create a new Session

`POST /session`

Authentication: no security requirement declared for this operation.

Request body: application/x-www-form-urlencoded (required)

Type: object

- `email` (required)
  Type: string

- `password` (required)
  Type: string, password

Responses:

- 200: OK

Content type: application/json

Type: User

Schema: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md)

- `id` (optional)
  Type: integer, int64
  
  Unique user identifier

- `name` (optional)
  Type: string
  
  User display name

- `email` (optional)
  Type: string
  
  Email address used for login and notifications

- `phone` (optional)
  Type: string; nullable
  
  Contact phone number for alerts

- `readonly` (optional)
  Type: boolean
  
  When true, the user cannot change settings

- `administrator` (optional)
  Type: boolean
  
  Grants full administrative privileges when enabled

- `map` (optional)
  Type: string; nullable
  
  Preferred default map layer for the user

- `latitude` (optional)
  Type: number
  
  Default map center latitude for this user

- `longitude` (optional)
  Type: number
  
  Default map center longitude for this user

- `zoom` (optional)
  Type: integer
  
  Default map zoom level on login

- `password` (optional)
  Type: string
  
  Password for user authentication

- `coordinateFormat` (optional)
  Type: string; nullable
  
  Preferred coordinate display format

- `disabled` (optional)
  Type: boolean
  
  Indicates whether the user account is disabled

- `expirationTime` (optional)
  Type: string, date-time; nullable
  
  in ISO 8601 format. eg. `1963-11-22T18:30:00Z`

- `deviceLimit` (optional)
  Type: integer
  
  Maximum number of devices the user can manage

- `userLimit` (optional)
  Type: integer
  
  Maximum number of subordinate users

- `deviceReadonly` (optional)
  Type: boolean
  
  Restricts user from modifying device attributes

- `limitCommands` (optional)
  Type: boolean
  
  Prevents user from sending unsupported commands

- `fixedEmail` (optional)
  Type: boolean
  
  Locks the email field to avoid changes

- `poiLayer` (optional)
  Type: string; nullable
  
  External POI layer configured for the user

- `attributes` (optional)
  Type: object
  
  Additional custom user attributes

- 401: Unauthorized

## Examples

### cURL

```bash
curl -X POST 'https://demo.traccar.org/api/session' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw 'email=string&password=%2A%2A%2A%2A%2A%2A%2A%2A'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/session', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: 'email=string&password=%2A%2A%2A%2A%2A%2A%2A%2A',
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.post(
    'https://demo.traccar.org/api/session',
    data='email=string&password=%2A%2A%2A%2A%2A%2A%2A%2A'.encode('utf-8'),
    headers={
        'Content-Type': 'application/x-www-form-urlencoded',
    },
)
print(response.text)
```


## Close the Session

`DELETE /session`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Responses:

- 204: No Content

- 401: Unauthorized

## Examples

### cURL

```bash
curl -X DELETE 'https://demo.traccar.org/api/session' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/session', {
  method: 'DELETE',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
  },
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.delete(
    'https://demo.traccar.org/api/session',
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    },
)
print(response.text)
```


## Open a Session as another User

`GET /session/{id}`

Admin or manager only. Establishes a session impersonating the specified user.

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Parameters:

- `id` (path, integer, required)
  Type: integer

Responses:

- 200: OK

Content type: application/json

Type: User

Schema: [User](https://sourcey-traccar.pages.dev/api-reference/models/user/index.md)

- `id` (optional)
  Type: integer, int64
  
  Unique user identifier

- `name` (optional)
  Type: string
  
  User display name

- `email` (optional)
  Type: string
  
  Email address used for login and notifications

- `phone` (optional)
  Type: string; nullable
  
  Contact phone number for alerts

- `readonly` (optional)
  Type: boolean
  
  When true, the user cannot change settings

- `administrator` (optional)
  Type: boolean
  
  Grants full administrative privileges when enabled

- `map` (optional)
  Type: string; nullable
  
  Preferred default map layer for the user

- `latitude` (optional)
  Type: number
  
  Default map center latitude for this user

- `longitude` (optional)
  Type: number
  
  Default map center longitude for this user

- `zoom` (optional)
  Type: integer
  
  Default map zoom level on login

- `password` (optional)
  Type: string
  
  Password for user authentication

- `coordinateFormat` (optional)
  Type: string; nullable
  
  Preferred coordinate display format

- `disabled` (optional)
  Type: boolean
  
  Indicates whether the user account is disabled

- `expirationTime` (optional)
  Type: string, date-time; nullable
  
  in ISO 8601 format. eg. `1963-11-22T18:30:00Z`

- `deviceLimit` (optional)
  Type: integer
  
  Maximum number of devices the user can manage

- `userLimit` (optional)
  Type: integer
  
  Maximum number of subordinate users

- `deviceReadonly` (optional)
  Type: boolean
  
  Restricts user from modifying device attributes

- `limitCommands` (optional)
  Type: boolean
  
  Prevents user from sending unsupported commands

- `fixedEmail` (optional)
  Type: boolean
  
  Locks the email field to avoid changes

- `poiLayer` (optional)
  Type: string; nullable
  
  External POI layer configured for the user

- `attributes` (optional)
  Type: object
  
  Additional custom user attributes

- 401: Unauthorized

- 404: Not found

## Examples

### cURL

```bash
curl -X GET 'https://demo.traccar.org/api/session/0' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/session/0', {
  method: 'GET',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
  },
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.get(
    'https://demo.traccar.org/api/session/0',
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    },
)
print(response.text)
```


## Generate Session Token

`POST /session/token`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Request body: application/x-www-form-urlencoded

Type: object

- `expiration` (optional)
  Type: string, date-time

Responses:

- 200: Token string

Content type: text/plain

Type: string

- 400: Bad request

- 401: Unauthorized

## Examples

### cURL

```bash
curl -X POST 'https://demo.traccar.org/api/session/token' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw 'expiration=2024-01-15T09%3A30%3A00Z'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/session/token', {
  method: 'POST',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: 'expiration=2024-01-15T09%3A30%3A00Z',
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.post(
    'https://demo.traccar.org/api/session/token',
    data='expiration=2024-01-15T09%3A30%3A00Z'.encode('utf-8'),
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
        'Content-Type': 'application/x-www-form-urlencoded',
    },
)
print(response.text)
```


## Revoke Session Token

`POST /session/token/revoke`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Request body: application/x-www-form-urlencoded (required)

Type: object

- `token` (required)
  Type: string

Responses:

- 204: No Content

- 400: Bad request

## Examples

### cURL

```bash
curl -X POST 'https://demo.traccar.org/api/session/token/revoke' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw 'token=string'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/session/token/revoke', {
  method: 'POST',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: 'token=string',
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.post(
    'https://demo.traccar.org/api/session/token/revoke',
    data='token=string'.encode('utf-8'),
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
        'Content-Type': 'application/x-www-form-urlencoded',
    },
)
print(response.text)
```


## Begin OpenID Connect authentication

`GET /session/openid/auth`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Responses:

- 303: Redirect to OpenID Connect identity provider

- 400: OpenID Connect is not configured

- default: Unexpected error

## Examples

### cURL

```bash
curl -X GET 'https://demo.traccar.org/api/session/openid/auth' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/session/openid/auth', {
  method: 'GET',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
  },
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.get(
    'https://demo.traccar.org/api/session/openid/auth',
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    },
)
print(response.text)
```


## OpenID Callback

`GET /session/openid/callback`

Authentication (security requirement alternatives):

```json
[
  {
    "BasicAuth": []
  },
  {
    "ApiKey": []
  }
]
```

- BasicAuth: http (basic)
- ApiKey: http (bearer)

Responses:

- 303: Successful authentication, redirect to homepage

- 400: Invalid or expired callback parameters

- default: Unexpected error

## Examples

### cURL

```bash
curl -X GET 'https://demo.traccar.org/api/session/openid/callback' \
  -H 'Authorization: Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE'
```

### JavaScript

```javascript
const response = await fetch('https://demo.traccar.org/api/session/openid/callback', {
  method: 'GET',
  headers: {
    'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
  },
});

const data = await response.text();
```

### Python

```python
import requests

response = requests.get(
    'https://demo.traccar.org/api/session/openid/callback',
    headers={
        'Authorization': 'Basic WU9VUl9VU0VSTkFNRTpZT1VSX1BBU1NXT1JE',
    },
)
print(response.text)
```