Sessions
Create and read conversation sessions — /sessions, /sessions/list, /sessions/{session_id}.
Sessions persist a conversation's messages and events so an agent can resume where it left off.
Base URL: https://api.misar.io/coder. All three endpoints authenticate with Authorization: Bearer <API_KEY>.
Sessions are scoped by a hash of your token
Ownership is derived from a hash of the bearer token, not from a user record. Rotating your API key makes previously created sessions unreachable. Sessions created while the deployment had no key configured are unowned and visible to everyone.
List sessions
/sessions/listYour sessions, most recent first.
Query parameters
limitnumberquerydefault: 50Sessions to return, between 1 and 500.
Response fields
sessionsobject[]Session summaries with id, created_at, workspace_root, preview, message_count, and last_activity.
countnumberNumber of sessions returned.
curl "https://api.misar.io/coder/sessions/list?limit=50" \
-H "Authorization: Bearer $MISARCODER_API_KEY"{
"sessions": [
{
"id": "sess_7d1c…",
"created_at": "2026-08-04T09:00:00.000Z",
"workspace_root": "/Users/jane/acme-api",
"preview": "Add pagination to the reports endpoint",
"message_count": 18,
"last_activity": "2026-08-04T09:41:22.000Z"
}
],
"count": 1
}preview is the first user message, truncated to 120 characters.
This endpoint degrades rather than failing
If the session store is not initialised, GET /sessions/list returns 200 with an empty list — while POST /sessions and GET /sessions/{id} return 503 in the same situation. An empty list is not proof there are no sessions.
Status codes
| Code | Meaning |
|---|---|
200 | Sessions returned, possibly empty |
401 | Missing or invalid Authorization header or Invalid API key |
422 | limit outside 1–500 |
Create a session
/sessionsQuery parameters, not a JSON body
This endpoint reads both values from the query string. A JSON body is ignored — a common source of "why is workspace_root always empty?"
Query parameters
session_idstringquerySupply your own id. Omit to have one generated. Re-sending an existing id is a no-op rather than an error.
workspace_rootstringqueryAbsolute workspace path. Defaults to an empty string.
Response fields
session_idstringThe session id — the one you supplied, or a newly generated one.
curl -X POST "https://api.misar.io/coder/sessions?workspace_root=/Users/jane/acme-api" \
-H "Authorization: Bearer $MISARCODER_API_KEY"{ "session_id": "sess_7d1c…" }Status codes
| Code | Meaning |
|---|---|
200 | Session created, or already existed |
401 | Missing or invalid Authorization header or Invalid API key |
503 | Session manager not initialized |
Get a session
/sessions/{session_id}The session record with its message history and event log.
Path parameters
session_idstringpathrequiredThe session id.
Response fields
sessionobject | null{ id, created_at, workspace_root, owner_hash }.
messagesArray<{role, content, created_at}>The conversation, in order.
eventsArray<{type, payload, created_at}>Recorded events. Capped at the 200 most recent.
curl https://api.misar.io/coder/sessions/sess_7d1c… \
-H "Authorization: Bearer $MISARCODER_API_KEY"{
"session": {
"id": "sess_7d1c…",
"created_at": "2026-08-04T09:00:00.000Z",
"workspace_root": "/Users/jane/acme-api",
"owner_hash": "9f2c…"
},
"messages": [
{ "role": "user", "content": "Add pagination", "created_at": "2026-08-04T09:00:04.000Z" }
],
"events": []
}Status codes
| Code | Meaning |
|---|---|
200 | Session returned |
401 | Missing or invalid Authorization header or Invalid API key |
404 | Session not found — also returned when the session belongs to another token |
503 | Session manager not initialized |
Another token's session is a 404
Cross-owner access is refused as 404, not 403 — the API never confirms that another owner's session id exists.