List sessions

Workspace API key, created in the dashboard under Settings → API Keys.

Workspace the request is scoped to. Optional for API keys: a key is bound to one workspace when it is created, and naming any other workspace returns an opaque 404.

Exact device id match.

Exact single-status match, applied verbatim (not filtered to the known vocabulary). Use statuses for a multi-status include/exclude filter.

Comma-separated list of DB statuses, included or excluded per statusMode. Entries outside the known vocabulary (queued, running, executing, awaiting_human, completed, complete, cancelled, failed) are dropped silently — an unrecognised spelling filters nothing rather than failing the request.

Applies to statuses only. include = "is" / "is any of"; exclude = "is not" / "is not any of".

Case-insensitive substring matched against the user-set name OR the first prompt. Both columns are tested on every request — the prompt is a second match source, not only a fallback for a session with no name set. The value is sanitized before it is matched: ,, (, ) and " are replaced with spaces, because those characters are reserved by the filter expression the term is embedded in — so foo,bar matches foo bar, not a stored foo,bar. A term consisting only of substituted characters sanitizes to empty, and the filter is then skipped: the listing is returned unfiltered rather than as an empty result.

Case-insensitive substring over the device name OR its id.

Exclusive upper bound on created_at, as a UTC instant with an uppercase Z suffix. Seconds and fractional seconds are optional, matching the handler (2026-09-13T12:00Z, 2026-09-13T12:00:00Z, 2026-09-13T12:00:00.5Z). A numeric offset such as +02:00 — valid RFC 3339, but rejected by the handler — and any other malformed value are a 400. The pattern cannot express month lengths, so a nonexistent calendar date such as 2026-02-29T12:00:00Z still matches it even though the handler rejects that request; no other keyword on this parameter rejects it either.

Inclusive lower bound on created_at, as a UTC instant with an uppercase Z suffix. Seconds and fractional seconds are optional, matching the handler (2026-09-13T12:00Z, 2026-09-13T12:00:00Z, 2026-09-13T12:00:00.5Z). A numeric offset such as +02:00 — valid RFC 3339, but rejected by the handler — and any other malformed value are a 400. The pattern cannot express month lengths, so a nonexistent calendar date such as 2026-02-29T12:00:00Z still matches it even though the handler rejects that request; no other keyword on this parameter rejects it either.