This version is still in development and is not considered stable yet. For the latest stable version, please use Spring Boot 4.0.1!

Sessions (sessions)

The sessions endpoint provides information about the application’s HTTP sessions that are managed by Spring Session.

Retrieving Sessions

To retrieve the sessions, make a GET request to /actuator/sessions, as shown in the following curl-based example:

$ curl 'http://localhost:8080/actuator/sessions?username=alice' -i -X GET

The preceding examples retrieves all of the sessions for the user whose username is alice. The resulting response is similar to the following:

HTTP/1.1 200 OK
Content-Type: application/vnd.spring-boot.actuator.v3+json
Content-Length: 789

{
  "sessions" : [ {
    "attributeNames" : [ ],
    "creationTime" : "2026-01-06T16:01:40.380636177Z",
    "expired" : false,
    "id" : "4db5efcc-99cb-4d05-a52c-b49acfbb7ea9",
    "lastAccessedTime" : "2026-01-06T21:01:03.380639193Z",
    "maxInactiveInterval" : 1800
  }, {
    "attributeNames" : [ ],
    "creationTime" : "2026-01-06T09:01:40.378267580Z",
    "expired" : false,
    "id" : "b620c521-be56-4b37-84b5-133951c61dff",
    "lastAccessedTime" : "2026-01-06T21:00:55.378278931Z",
    "maxInactiveInterval" : 1800
  }, {
    "attributeNames" : [ ],
    "creationTime" : "2026-01-06T19:01:40.380641728Z",
    "expired" : false,
    "id" : "80c5f0fd-a75c-4d56-b5fa-fe6bad6d0c5e",
    "lastAccessedTime" : "2026-01-06T21:01:28.380642309Z",
    "maxInactiveInterval" : 1800
  } ]
}

Query Parameters

The endpoint uses query parameters to limit the sessions that it returns. The following table shows the single required query parameter:

Parameter Description

username

Name of the user.

Response Structure

The response contains details of the matching sessions. The following table describes the structure of the response:

Path Type Description

sessions

Array

Sessions for the given username.

sessions.[].id

String

ID of the session.

sessions.[].attributeNames

Array

Names of the attributes stored in the session.

sessions.[].creationTime

String

Timestamp of when the session was created.

sessions.[].lastAccessedTime

String

Timestamp of when the session was last accessed.

sessions.[].maxInactiveInterval

Number

Maximum permitted period of inactivity, in seconds, before the session will expire.

sessions.[].expired

Boolean

Whether the session has expired.

Retrieving a Single Session

To retrieve a single session, make a GET request to /actuator/sessions/{id}, as shown in the following curl-based example:

$ curl 'http://localhost:8080/actuator/sessions/4db5efcc-99cb-4d05-a52c-b49acfbb7ea9' -i -X GET

The preceding example retrieves the session with the id of 4db5efcc-99cb-4d05-a52c-b49acfbb7ea9. The resulting response is similar to the following:

HTTP/1.1 200 OK
Content-Type: application/vnd.spring-boot.actuator.v3+json
Content-Length: 208

{"attributeNames":[],"creationTime":"2026-01-06T16:01:40.380636177Z","expired":false,"id":"4db5efcc-99cb-4d05-a52c-b49acfbb7ea9","lastAccessedTime":"2026-01-06T21:01:03.380639193Z","maxInactiveInterval":1800}

Response Structure

The response contains details of the requested session. The following table describes the structure of the response:

Path Type Description

id

String

ID of the session.

attributeNames

Array

Names of the attributes stored in the session.

creationTime

String

Timestamp of when the session was created.

lastAccessedTime

String

Timestamp of when the session was last accessed.

maxInactiveInterval

Number

Maximum permitted period of inactivity, in seconds, before the session will expire.

expired

Boolean

Whether the session has expired.

Deleting a Session

To delete a session, make a DELETE request to /actuator/sessions/{id}, as shown in the following curl-based example:

$ curl 'http://localhost:8080/actuator/sessions/4db5efcc-99cb-4d05-a52c-b49acfbb7ea9' -i -X DELETE

The preceding example deletes the session with the id of 4db5efcc-99cb-4d05-a52c-b49acfbb7ea9.