Logins, stats and audit

A user’s sessions and sign-ins

GET/seller/v1/user/sessionsscope: logins

The user’s latest 50 sessions and 50 sign-in events, and the keys linked to them.

Query	Required
user_id	yes

200 OK

{
  "ok": true,
  "data": {
    "sessions": [
      {
        "session_ref": "2f95928ca04e",
        "hwid": "95d4f53f6a9e855cb8a0a7d1a98770c287452aa2af71c77b4be6a3e99703754f",
        "ip": "203.0.113.24",
        "created_at": 1794497605,
        "last_seen_at": 1794497605,
        "expires_at": 1794498505,
        "absolute_expires_at": 1794540805,
        "revoked_at": 1794497606,
        "revoke_reason": "hwid_reset"
      }
    ],
    "events": [
      { "id": 4, "event": "register", "ip": "203.0.113.24", "reason": "key_login", "created_at": 1794497605 }
    ],
    "keys": [
      { "id": "lic_29a9789d2f1640e88617a4d5f61116ac", "key_hint": "5G2T", "tier": "Default", "type": "days", "duration_days": 30, "activated_at": 1794497605, "expires_at": null, "status": "active" }
    ]
  }
}

• expires_at is the idle expiry (pushed forward by heartbeats); absolute_expires_at is the max session length.
• revoked_at and revoke_reason are set for sessions that were ended (ban, HWID reset, logout, revoked key, and so on). A session with neither, before expires_at, is live.
• session_ref is a short reference, never the session token.

App stats

GET/seller/v1/statsscope: any

The numbers behind the panel’s Overview. Any token can call it; each section is filled only when the token has its scope, and is null otherwise.

Query	Notes
app_id	Your token’s app

Field	Needs
licenses (counts by status), keys_issued_this_week, keys_redeemed_this_week	licenses
users (total, banned)	users
free (free devices; null when there are none)	users
active_sessions, logins_by_day, failed_logins_last_hour, alerts	logins
recent_audit (latest 10 entries)	audit
per_app (keys, unused keys, users)	any

200 OK

{
  "ok": true,
  "data": {
    "active_sessions": 0,
    "licenses": { "unused": 5, "active": 0, "redeemed": 2, "expired": 0, "banned": 0 },
    "users": { "total": 2, "banned": 0 },
    "logins_by_day": [{ "day": "2026-11-12", "logins": 2, "failed": 0 }],
    "recent_audit": [
      { "id": 53, "actor_type": "admin", "actor_email": "api-token:docs-bot", "app_id": "app_ea9745b1df9e4a9bacb22cb1c200993b", "action": "file.delete", "target_id": "file_81623b66014f4360845792dcb77f8e69", "created_at": 1794497607 }
    ],
    "free": null,
    "alerts": [],
    "per_app": { "app_ea9745b1df9e4a9bacb22cb1c200993b": { "keys": 7, "unused_keys": 5, "users": 2 } },
    "keys_issued_this_week": 7,
    "keys_redeemed_this_week": 2,
    "failed_logins_last_hour": 0
  }
}

alerts gets an entry when failed sign-ins in the last hour are unusually high (at least 10 and more than three times the hourly average).

Audit log

GET/seller/v1/audit-logscope: audit

Query	Notes
app_id	Your token’s app
actor	An exact actor email or ID, for example api-token:docs-bot
action	Actions starting with this, for example license.
from, to	Unix seconds
page, page_size	See paging

Newest first.

200 OK

{
  "ok": true,
  "data": {
    "items": [
      {
        "id": 53,
        "actor_id": "tok_2ad338dbbfe44929977a4c4525a9e274",
        "actor_type": "admin",
        "actor_email": "api-token:docs-bot",
        "app_id": "app_ea9745b1df9e4a9bacb22cb1c200993b",
        "action": "file.delete",
        "target_id": "file_81623b66014f4360845792dcb77f8e69",
        "ip": "198.51.100.10",
        "metadata": { "name": "settings.json" },
        "created_at": 1794497607
      }
    ],
    "total": 45,
    "page": 1,
    "page_size": 50
  }
}

Actions are named <thing>.<verb>, such as license.create, license.revoke, user.ban, users.time_adjust, blacklist.add, variable.update, file.upload. metadata holds the details of the change; it never contains variable values or whole keys.