# The agent sessions that used each credential (owner only), read from the change feed: harness, model, tool calls, row changes, operations and tables, the most recent first.

`POST /datanotes/sessions/` (operation `list_sessions`)

Each session groups the change feed's events of one credential (`owner` or a token's name) and one agent session (compared on its first 16 characters); a credential's work without a session is one entry with `session: null`. Hand edits and background work have no credential and are left out. A named token is refused (403), even with `maintain`.

## Request body

`application/json`

| Property | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `token` | `string` | no |  | Only this credential: `owner` or a token's name. |
| `since` | `string` | no |  | ISO date-time: the earliest event to look at. Default: 7 days ago. |
| `limit` | `integer` | no | `100` | The most sessions to return. |

## Responses

| Status | Description | Body |
| --- | --- | --- |
| 200 | Done. | `object` (application/json) |
| 400 | Bad input: the body is not a JSON object, or an argument is unknown, missing or of the wrong type. | `Error` (application/json) |
| 401 | Missing or wrong bearer token. | `Error` (application/json) |
| 403 | A named token beyond its permissions (the engine's administration, tables outside its `write` patterns, schema changes without `ddl`). | `Error` (application/json) |
| 500 | Unexpected error. | `Error` (application/json) |
| 503 | The change feed is not running. | `Error` (application/json) |

The schemas named here are in [openapi.json](https://datanotes.dev/openapi.json) (`components.schemas`).