Page Sessions visible to the installation
package main
import ( "fmt" "net/http" "io")
func main() {
url := "https://api.vampikez.fun/v1/sessions?limit=50&archived=exclude"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close() body, _ := io.ReadAll(res.Body)
fmt.Println(res) fmt.Println(string(body))
}const url = 'https://api.vampikez.fun/v1/sessions?limit=50&archived=exclude';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.vampikez.fun/v1/sessions?limit=50&archived=exclude' \ --header 'Authorization: Bearer <token>'Requires wamp.cloud.sessions:read. Ordered newest-updated first and paged by an opaque cursor: pass the previous page’s nextCursor back verbatim and stop when hasMore is false. Because the sort key is updatedAt, a Session that changes mid-walk can move between pages — treat this as a browse surface and use the per-Session event log when you need exactness. Only Sessions this installation created or was granted access to are visible; a hand-built or foreign cursor is a 400, not an empty page.
Narrow the page instead of walking it. originTenantKey, originObjectType and originObjectId match the immutable origin correlation triple exactly — no prefixes, ranges or wildcards — so the record id you already store is enough to find its Session without keeping your own index. Sending originObjectType or originObjectId without originTenantKey is a 400: the tenant key is what keeps the lookup indexed. Sessions created before this filter shipped are matched too. archived selects which side of the archive boundary is listed and defaults to exclude, so an unmodified caller keeps seeing exactly the live catalog it saw before.
Authorizations
Section titled “Authorizations”Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters”Opaque exclusive cursor returned by the previous page
Sessions per page, 1-100, default 50
Which side of the archive boundary to page: exclude lists live Sessions only and is the default, include lists both, only lists archived Sessions
Exact origin.tenantKey to match. Required whenever originObjectType or originObjectId is sent, because it is the indexed anchor of an origin lookup
Exact origin.objectType to match, within originTenantKey
Exact origin.objectId to match, within originTenantKey
Responses
Section titled “ Responses ”Session page
One page of the Sessions this credential may see, ordered by updatedAt descending so active work sorts first. Archived Sessions are excluded unless archived asks for them, and always carry archivedAt.
object
Sessions on this page, most recently updated first
The durable unit of agent work: a Session owns its Turns, Runs, Events, Artifacts and Publications, and outlives any sandbox that happens to be executing it.
object
The caller-owned Session id, unchanged from the create request
Canonical first-party browser URL for handing this Session to a human
Organization that owns the Session; every credential is authorized against this organization
Human-facing name — the supplied title, first non-empty line of initialTurn.message, or New workspace for an idle Session
Correlation metadata supplied at creation; absent when none was sent
object
Stable opaque identifier for the external tenant the work belongs to, not its display name
The caller’s own kind name for the originating record, such as ticket or issue
The caller’s stable opaque id for that record, so a Session can always be traced back to the business object
Stable one-way hash of the external tenant/user pair; never raw PII.
Short human-readable name for the originating record, shown when the Session is handed to a person
HTTPS deep link back to the originating record in the caller’s product
Repository checked out into the sandbox, with the exact base the Session was pinned to; absent for a Session with no repository
object
object
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
Lowercase hex 40-character Git object id naming an exact commit or tree in the source repository.
Model in effect for the next Turn; absent when a runtime-managed agent supplies its own default
The settled foreign agent runtime id, such as claude-code or codex; absent means the native WAMP runtime
Sandbox attachment — unavailable when no lease is held, attached with the lease expiresAt, expired once that lease has lapsed; losing it does not end the Session
object
Whether and at what fidelity this Session can be carried into another Run
object
Whether a new Turn can be admitted for this Session — nothing more. It is NOT the answer to “did my previous work survive”: a fresh Session reports canContinue: true with both fidelities none, so a caller that branches on this field alone starts over believing it resumed. reason is the field that answers the other question, and it is present here whenever prior work will not carry. canContinue is false only while state is unavailable.
live while a sandbox lease is still held, fresh before any Run has been accepted, restorable when a sealed checkpoint can be replayed into a new sandbox, unavailable when neither is possible
Fidelity the conversation would be restored at — live in an attached sandbox, exact from a full checkpoint, result_only when just prior results survive, none when nothing does
object
Fidelity the working tree would be restored at — live, portable_tree from a checkpointed tree, or none
object
The Run whose completion sealed the checkpoint this projection describes; absent when no checkpoint exists
Why a next Turn will NOT carry this Session’s previous work. Present exactly when it will not, and absent exactly when it will — so reason == null is the one check that means “resuming here keeps what happened”. no_prior_work accompanies state: fresh and canContinue: true: the Session accepts a Turn and has nothing to carry. The other four accompany state: unavailable and canContinue: false, and name why a restore is impossible rather than merely empty.
Last execution phase the control plane recorded for this Session — a closed set, safe to switch on exhaustively, and additions arrive with a contract change. It remains advisory presentation state: the Run carries the authoritative status, and phase may lag it between a Run’s terminal transition and reconciliation.
Whether a human user or an App installation created the Session, and that actor’s id; an installation-created Session keeps its App authority even when a human later manages it
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
Present exactly while this Session has a Run that is not terminal, awaiting included. It is set at admission, so it is already there while the Run is queued or dispatching and before the Run reaches a sandbox or writes its first event — which is the window in which a Turn is refused with 409 cloud_run_in_progress and the Event log is still empty. The one exception is a Run that has ended and is finalizing (phase: finalizing): a follow-up Turn is admitted and queued behind it, and becomes this field. This is the id to cancel, and the id to read GET /v1/sessions/{sessionId}/runs/{runId} with when you did not mint the Turn yourself.
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
When the Session was admitted
Last time durable Session state changed; the Session list is ordered by this value descending
Sequence of the newest Event in this Session’s log, 0 before the first. Page GET /v1/sessions/{sessionId}/events only when your cursor is below it
When the Session was archived. Present only on an archived Session — which is readable but closed: it is hidden from the default catalog page, reports continuation.canContinue false with reason session_archived, and rejects every command
Opaque exclusive keyset cursor derived from the last item’s updatedAt and id; send it back unchanged as cursor and never parse or construct it yourself
Whether more Sessions follow this page — stop paging on this flag, not on a null cursor
Example
{ "sessions": [ { "id": "9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731", "sessionUrl": "https://cloud.wamp.dev/sessions/9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731", "organizationId": "0b9a6f3e-5c21-4d78-9e64-8f1a2b7c3d05", "title": "Rate limit the payments endpoint", "origin": { "tenantKey": "acme", "objectType": "issue", "objectId": "PAY-4821", "endUserId": "9c1f0a7d4b62e35810af2d6c95b7e043", "label": "PAY-4821 Rate limit the payments endpoint", "url": "https://acme.example.com/issues/PAY-4821" }, "source": { "kind": "github", "grantId": "74c5a903-8e6f-4b1d-a052-3c9e18d7f64b", "label": "acme/checkout-service", "private": true, "baseBranch": "main", "baseOid": "5a3e170c93eda8209e3f5592fe1e1d9976fe26ab" }, "model": "claude-opus-5", "runtime": "wamp", "workspace": { "state": "attached", "expiresAt": "2026-08-12T11:40:00Z" }, "continuation": { "canContinue": true, "state": "live", "conversation": { "fidelity": "live" }, "workspace": { "fidelity": "live" } }, "phase": "running", "createdBy": { "kind": "app_installation", "id": "e3f7b219-6c40-4a8e-b591-07d2c48f3a65" }, "activeRun": { "id": "c47a1e08-3d6b-4a92-9f15-8b70d2e5c6a4" }, "createdAt": "2026-08-12T09:20:14Z", "updatedAt": "2026-08-12T09:41:02Z", "lastEventSequence": 37, "environment": null, "parent": null }, { "id": "4d81a6c2-90fb-4e37-8a15-c7be2f930d68", "sessionUrl": "https://cloud.wamp.dev/sessions/4d81a6c2-90fb-4e37-8a15-c7be2f930d68", "organizationId": "0b9a6f3e-5c21-4d78-9e64-8f1a2b7c3d05", "title": "Upgrade the checkout service to Node 22", "source": { "kind": "github", "grantId": "74c5a903-8e6f-4b1d-a052-3c9e18d7f64b", "label": "acme/checkout-service", "private": true, "baseBranch": "main", "baseOid": "4e6a86e45e9999efbe0c50ad3cc311ca9d214f61" }, "model": "claude-opus-5", "runtime": "wamp", "workspace": { "state": "unavailable" }, "continuation": { "canContinue": true, "state": "restorable", "conversation": { "fidelity": "exact" }, "workspace": { "fidelity": "portable_tree" }, "boundaryRunId": "8f2d5b41-6e0c-47a9-b3d8-51ca9e07f2b6" }, "phase": "idle", "createdBy": { "kind": "app_installation", "id": "e3f7b219-6c40-4a8e-b591-07d2c48f3a65" }, "createdAt": "2026-08-11T16:02:47Z", "updatedAt": "2026-08-11T17:31:09Z", "lastEventSequence": 24, "environment": null, "parent": null } ], "nextCursor": "eyJ2IjoxLCJraW5kIjoic2Vzc2lvbnMiLCJhdCI6IjIwMjYtMDgtMTFUMTc6MzE6MDkuMDAwWiIsImlkIjoiNGQ4MWE2YzItOTBmYi00ZTM3LThhMTUtYzdiZTJmOTMwZDY4In0", "hasMore": true}Malformed request
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "invalid_request"}No bearer was presented (bearer_credential_required), or the one presented is expired, revoked or for another audience (invalid_or_expired_credential)
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "bearer_credential_required"}Live installation, scope or organization policy denies the operation
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "insufficient_scope", "requiredScope": "wamp.cloud.sessions:create"}The pre-authentication edge budget or durable human-membership/App-installation budget is exhausted
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "cloud_rate_limit_exceeded", "retryAfterSeconds": 3}Headers
Section titled “Headers”IETF HTTPAPI structured quota policy
IETF HTTPAPI structured current service limit
The request was accepted and something on our side failed while answering it. Nothing about the request needs to change; the same call may succeed on retry. Retry cautiously, with backoff — a non-idempotent command may have taken effect before the fault.
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "internal_error"}A retryable condition: a workspace, runtime or provider that is not available yet, or service_unavailable while the service restarts for a release or its database cannot serve the request in time. Retry after the Retry-After this response carries.
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "cloud_workspace_unavailable"}