List Session Messages
Sessions
List Session Messages
Return the active turns of a session owned by the authenticated user.
Messages come back oldest-first (transcript order), paginated. The ownership gate runs first: a session that does not exist or belongs to another user returns 404 (not 403, not an empty 200), exactly as the PATCH/DELETE routes do, so an empty page cannot be confused with a cross-tenant miss. An owned session with no messages returns 200 with an empty array and total 0.
IDOR AUDIT PASS — the ownership lookup filters by Session.user_id, and
list_messages re-filters by user_id AND session_id.
GET
List Session Messages
Authorizations
EDN API key presented as 'Bearer ' in the Authorization header. Create and manage keys from the Console.
Path Parameters
Query Parameters
Max messages to return (capped at 200)
Required range:
x >= 1Pagination offset
Required range:
x >= 0