List interactive sessions visible to the caller.
Same auth posture as POST: session/user_token only. `?project=<slug>` or `?projectId=<id>` scopes to one project (gated by checkInteractiveAccess - an inaccessible project returns an empty list, not an error). Omitted, the list is scoped to every project the caller can see in the org (org admins see all).
Rensei API key presented as Authorization: Bearer rsk_live_. Required API-key scopes are recorded per operation in x-rensei-required-scopes.
In: header
Query Parameters
Project slug.
Project id. Takes priority over project when both are supplied.
Response Body
application/json
curl -X GET "https://example.com/api/interactive-sessions"{
"sessions": [
{
"id": "string",
"sessionId": "string",
"orgId": "string",
"projectId": "string",
"createdByUserId": "string",
"status": "provisioning",
"liveStatus": "string",
"poolId": "string",
"harness": "string",
"modelProfileId": "string",
"sandboxProvider": "string",
"localAuthAvailable": true,
"localAuthAvailableSource": "default",
"displayName": "string",
"executionLocation": {
"provider": "string",
"pool": {
"id": "string",
"displayName": "string"
},
"host": {
"id": "string",
"displayName": "string"
},
"sandboxFlavor": "string",
"runtimeFlavor": "string"
},
"startedAt": "string",
"endedAt": "string",
"createdAt": "string",
"updatedAt": "string"
}
]
}Get incident summary counts (by status, by severity) and MTTR.
Returns incident counts grouped by status and severity, a total, and mean-time-to-recovery (seconds) for the authenticated org. Bearer-reachable for human principals (user token or browser session); rsk_* API keys and BYOA OAuth-agent tokens are rejected 403.
Launch a new interactive PTY-attach session.
Authentication accepts a browser session or a WorkOS user token; an rsk API key or a BYOA OAuth-agent token authenticates successfully but is rejected 403 because interactive sessions require a human user identity for driver/viewer grant derivation. When initialPrompt is supplied, the handler trims it and enforces an exact 1,023 UTF-8-byte limit without truncation; the schema maxLength is only a coarse character bound. Entitlement-gated (403 when the org lacks the interactive_sessions feature flag) and quota-gated (429 with {code, limit, current} when the org is at its concurrent-inflight or monthly-attached-seconds cap). Unpinned axes (poolId, harness, modelProfileId, repositoryId, sandboxProvider) resolve through the project/org default cascade - this path never routes through MAB.