> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get session > Gets an Agent Vault session. ## OpenAPI ````yaml GET /api/v1/agent-vault/sessions/{sessionId} openapi: 3.0.3 info: title: Infisical API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server security: [] paths: /api/v1/agent-vault/sessions/{sessionId}: get: tags: - Agent Vault Sessions description: Gets an Agent Vault session. operationId: getAgentVaultSession parameters: - schema: type: string format: uuid in: path name: sessionId required: true description: The ID of the session. responses: '200': description: Default Response content: application/json: schema: type: object properties: session: type: object properties: id: type: string format: uuid description: The ID of the session. label: type: string nullable: true description: >- A short description of what the session is for, such as `nightly deploy` or `support ticket triage`. Up to 128 characters, without line breaks, tabs, or invisible characters. Shown wherever the session is listed. actor: anyOf: - type: object properties: type: type: string enum: - user description: >- Whether the session belongs to a user or a machine identity. id: type: string format: uuid nullable: true description: >- The ID of the user or machine identity the session belongs to, or null if it was deleted. username: type: string description: >- The username of the user. Once the user is deleted, the email recorded when the session was created. email: type: string nullable: true description: >- The email address of the user. Once the user is deleted, the email recorded when the session was created. firstName: type: string nullable: true description: >- The first name of the user. Once the user is deleted, the full name recorded when the session was created. lastName: type: string nullable: true description: >- The last name of the user, or null once the user is deleted. required: - type - id - username - email - firstName - lastName additionalProperties: false title: User - type: object properties: type: type: string enum: - machineIdentity description: >- Whether the session belongs to a user or a machine identity. id: type: string format: uuid nullable: true description: >- The ID of the user or machine identity the session belongs to, or null if it was deleted. name: type: string description: >- The name of the machine identity. Once the machine identity is deleted, the name recorded when the session was created. required: - type - id - name additionalProperties: false title: Machine identity onBehalfOf: type: object properties: type: type: string enum: - user description: >- Always user: a machine identity starts sessions only on behalf of users. id: type: string format: uuid nullable: true description: >- The ID of the user, or null once the user is deleted. username: type: string description: >- The username of the user. Once the user is deleted, the email recorded when the session was created. email: type: string nullable: true description: >- The email address of the user. Once the user is deleted, the email recorded when the session was created. firstName: type: string nullable: true description: >- The first name of the user. Once the user is deleted, the full name recorded when the session was created. lastName: type: string nullable: true description: >- The last name of the user, or null once the user is deleted. required: - type - id - username - email - firstName - lastName additionalProperties: false description: >- The user the machine identity in actor started this session on behalf of, or null when the session is the actor's own. title: User nullable: true status: type: string enum: - active - revoked - expired expiresAt: type: string format: date-time nullable: true description: When the session expires, or null when it never does. revokedAt: type: string format: date-time nullable: true createdAt: type: string format: date-time accessBundles: type: array items: type: object properties: id: type: string format: uuid nullable: true name: type: string position: type: number required: - id - name - position additionalProperties: false services: type: array items: type: object properties: id: type: string format: uuid description: The ID of the service sent with this session. name: type: string description: >- The name the service was sent with, or its first host if it was sent without one. Shown in session logs and in the proxy's error messages. type: type: string enum: - http - mcp description: >- The service type: `http` for an HTTP API, or `mcp` for a remote MCP server. Can't be changed after the service is created. serverUrl: type: string nullable: true description: >- The MCP server's full URL. Null for an `http` service. transport: type: string enum: - streamable-http - sse nullable: true description: >- How the agent talks to the MCP server: `streamable-http`, or `sse` for the legacy HTTP+SSE transport. Null for an `http` service. hostPattern: type: string description: >- A comma-separated set of hosts this service covers, each optionally with a port (defaults to `443`). A leading `*.` wildcard matches exactly one label. Paths are not supported. allowedMethods: type: array items: type: string enum: - GET - HEAD - POST - PUT - PATCH - DELETE - OPTIONS nullable: true description: >- The HTTP methods this service allows. Null allows every method. Anything else is refused by the proxy with a 403. allowedPathPrefixes: type: array items: type: string nullable: true description: >- The path prefixes this service allows, matched on whole segments, so `/repos` covers `/repos/octo` but not `/repositories`. `null` allows every path. A path-restricted service also refuses any request whose path would have to be normalised to judge. credential: anyOf: - type: object properties: type: type: string enum: - bearer headerName: type: string description: >- The header the credential is written to. Defaults to `Authorization`. headerPrefix: type: string description: >- Written before the credential value, separated by one space. Leave empty for a header that carries the value alone, such as DD-API-KEY. Can't contain `{{` or `}}`. On update a field left out keeps its stored value, so send an empty string to clear the prefix when changing the header. required: - type - headerName - headerPrefix additionalProperties: false title: Bearer - type: object properties: type: type: string enum: - basic required: - type additionalProperties: false title: Basic Auth - type: object properties: type: type: string enum: - passthrough required: - type additionalProperties: false title: Pass-through customHeaders: type: array items: type: object properties: name: type: string description: >- The name of the header, which must not be the credential's own header. prefix: type: string description: >- Written before the header value, separated by one space. Leave empty to send the value alone. Can't contain `{{` or `}}`. required: - name - prefix additionalProperties: false description: >- The headers the proxy attaches besides the credential, without their values. substitutions: type: array items: type: object properties: placeholder: type: string description: >- The fake value your agent already sends. The proxy replaces it with the real secret. Matched as a plain string, so a distinctive placeholder is worth choosing. Can't contain `{{` or `}}`. surfaces: type: array items: type: string enum: - path - query - header - body description: >- Where in the request to look for the placeholder: path, query, header or body. required: - placeholder - surfaces additionalProperties: false description: >- The placeholders the proxy swaps for a real secret, without their values. required: - id - name - type - serverUrl - transport - hostPattern - allowedMethods - allowedPathPrefixes - credential - customHeaders - substitutions additionalProperties: false description: >- The services sent with this session when it was created, without their secrets. Its access bundle's services aren't listed here. Empty when the session carries only an access bundle. required: - id - label - actor - onBehalfOf - status - expiresAt - revokedAt - createdAt - accessBundles - services additionalProperties: false required: - session additionalProperties: false example: session: id: d1f0b5a2-6c3e-4f8a-9b7d-2e4c6a8f0b13 label: Nightly deploy actor: type: machineIdentity id: 7b1e4f2a-9c3d-4a6b-8e5f-1d2c3b4a5e6f name: deploy-bot onBehalfOf: null status: active expiresAt: '2026-11-01T02:00:00.000Z' revokedAt: null createdAt: '2026-10-31T18:00:00.000Z' accessBundles: - id: 3c90c3cc-0d44-4b50-8888-8dd25736052a name: prod-deploy position: 0 services: [] '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.