Skip to content

Session Not Identified

URI: https://docs.ankatech.co/errors/session-not-identified
HTTP Status: 409 Conflict

When you see this

A person asked to end every one of their sessions except the one they are using (POST /api/v3/auth/account/sessions/revoke-others), and the access token they presented does not say which session it belongs to: it carries no sid claim. Without it, the calling session cannot be told apart from the person's other sessions, so the platform refuses the request rather than ending the calling session together with the others.

ankasecure-auth-api emits this type. The refusal happens before anything changes: no session is ended and no revocation epoch moves.

Common Causes

  • The access token was issued by a release of the platform that kept no logical session (before 3.3.0), and the person has not signed in again since.
  • During an upgrade to 3.3.0, the sign-in or refresh that issued the access token was served by an instance still running the previous release.

Response Example

{
  "type": "https://docs.ankatech.co/errors/session-not-identified",
  "title": "Session Not Identified",
  "status": 409,
  "detail": "Your access token does not identify the session it belongs to, so your other sessions cannot be told apart from this one. Sign in again, then repeat the request.",
  "instance": "/api/v3/auth/account/sessions/revoke-others",
  "timestamp": 1765057500
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The body names no session and no token identifier.

How to Resolve

  1. Sign in again. The new access token carries the sid of the session that sign-in creates.
  2. Repeat the request with the new access token.
  3. To end every session at once, the calling one included, use POST /api/v3/auth/account/sessions/revoke-all, which does not need to identify the calling session.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.