List embed sessions
Lists embed sessions newest first, cursor-paginated, filtered by external_user_id, loan_id and status. Each row carries the handle_id it was exchanged from, null for a session minted directly. The key that minted them lists its own; a workspace administrator lists every session in the organization.
Requires the embed:write scope. Rate limit: 200 requests per minute per key (the api lane).
Authentication
Bearer token. Use ss_live_… for live data or ss_test_… for the sandbox (test mode). See Authentication.
Headers
Pin the API version, e.g. 2026-10-07. Omit to get the latest. See Versioning.
Query parameters
Keeps sessions minted for this end user: the exact external_user_id the mint named.
Keeps one status: active (not yet expired, not revoked), expired or revoked. Any other value answers 400.
Page size, 1 to 100. Defaults to 50. A value outside the range answers 400 invalid_limit.
The next_cursor from the previous page, passed back verbatim. Omit it for the first page. A malformed cursor answers 400 invalid_cursor.
Response headers
The API surface version the server resolved for this request. Always present, regardless of whether the client supplied the request-side SpreadSpace-Version header. Default: 2026-10-07.
Request budget of the endpoint’s rate-limit policy per 60-second sliding window. See Rate limits.
Requests left in the current window. Suppressed on 429 responses produced outside the rate limiter (for example a usage throttle), where a remaining budget would be misleading.
Seconds until a guaranteed-fresh window.
The active policy in limit;w=window-seconds form.