# How can I retrieve all user sessions connected to my Kibana, using API

**URL:** <https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329>\
**Category:** Kibana\
**Created:** [November 3, 2021, 1:18pm UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329 "2021-11-03T13:18:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dicto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dicto/32/71489_2.png) [@dicto](https://discuss.elastic.co/u/dicto)\
**Post date:** [November 3, 2021, 1:18pm UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329/1 "2021-11-03T13:18:36Z")

</div>

Hi!

How can I retrieve all user sessions connected to my Kibana, using API ?

I will do a montoring sessions to delete duplicate access to my dashboard in Kibana.

I saw that its is possible to DELETE sessions using the API, but I did not see how to retrieve all the sessions to detect multiple access.

Thanks!  
Rodrigo

---

<div class="post-metadata">

**Author:** ![thomheymann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomheymann/32/87096_2.png) [@thomheymann](https://discuss.elastic.co/u/thomheymann)\
**Post date:** [November 4, 2021, 3:07pm UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329/2 "2021-11-04T15:07:25Z")

</div>

You can retrieve, extend, or delete the current session via an API but there’s no APIs to list or manage other users sessions.

Can you explain your use case in a bit more detail?

It might make more sense to define a session timeout or idle timeout and let Kibana delete expired sessions rather than trying to manage sessions yourself.

If it's primarily about detecting who accessed Kibana then your best bet would be the  
[Kibana Audit Log](https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html).

You can look for `user_login` + `success` events to detect when a user logged in. You can find the current session id in the `kibana.session_id` field.

---

<div class="post-metadata">

**Author:** ![dicto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dicto/32/71489_2.png) [@dicto](https://discuss.elastic.co/u/dicto)\
**Post date:** [November 4, 2021, 5:10pm UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329/3 "2021-11-04T17:10:18Z")

</div>

Hi Thom,

My case is simple: detect if a customer shared the password with another person.  
I need to detect two or more parallel accesses and then logout all.  
Thanks a lot!

---

<div class="post-metadata">

**Author:** ![thomheymann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomheymann/32/87096_2.png) [@thomheymann](https://discuss.elastic.co/u/thomheymann)\
**Post date:** [November 8, 2021, 10:21am UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329/4 "2021-11-08T10:21:58Z")

</div>

Thanks for clarifying.

You can use the audit log to detect if multiple sessions are active for the same user.

Keep in mind that multiple logins does not necessarily mean that the user shared their password. They could be using private browsing mode, a separate machine or simply a different browser so you might want to run additional checks before invalidating their session.

To invalidate a users session you can make the following API call with superuser privileges:

```auto
POST /api/security/session/_invalidate
{
  match: 'query',
  query: {
    provider: 'basic',
    username: 'user-to-logout'
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2021, 10:22am UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329/5 "2021-12-06T10:22:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.