List the caller's live CLI sessions

GET 
/api/auth/cli-sessions

List the caller's live CLI sessions. One entry per npx pt login — that is, per refresh-token FAMILY, not per token: a session that has refreshed twenty times is still one row. Browser-session only: the proxy rejects a request that carries no cookies, so a bearer API key cannot enumerate a user's sessions. A non-JSON upstream body is replaced with a DIRECTORY_INVALID_RESPONSE envelope while the UPSTREAM STATUS IS PRESERVED, so a 2xx can carry that error shape instead of data — the 200 schema below models both.

Responses

200

Successful response

401

No authenticated browser session — the request carried no cookies, or the session could not be resolved. requireBrowserSession rejects such a request before any upstream call, but only once selector resolution has already succeeded: withTenantHandler runs first, so a bad x-act-as-org surfaces as the 403 below instead.

403

The caller has no active organisation membership; or the x-act-as-org selector named an organisation the caller is not an ACTIVE member of — PT's withTenantHandler rejects that before the proxy runs.

502

Directory could not be reached, or its response body could not be read after headers had arrived — both are DIRECTORY_UNREACHABLE.

503

Directory timed out (DIRECTORY_TIMEOUT), or the deployment is missing its Directory URL configuration — surfaced explicitly rather than falling back to localhost and failing later as a confusing 502.