Onboarding Sessions

List onboarding sessions

GET/onboarding-sessions
onboarding:readlist_onboarding_sessionsRead-only

Lists onboarding sessions, newest started first, and returns one page. A session is one respondent's run through an onboarding flow. Give filter[flow_id] or filter[user_id] (422 without one). Sessions of other organisations' users and of service users never show. Filter by filter[status], filter[flow_test], filter[q] (the user's name) and the filter[started_at] and filter[completed_at] ranges. include=flow embeds each flow. Use GET /onboarding-sessions/{id} for one session. It changes nothing.

Query parameters

  • limitinteger#

    Page size (1–100). Defaults to 25; values are clamped to the range.

    Default: 25
  • cursorstring#

    Opaque pagination cursor taken from a prior response's meta.next_cursor.

  • fieldsstring#

    Comma-separated top-level fields to return. id is always returned.

  • includestring#

    Set to flow to embed each session's onboarding flow, with its routes.

  • sortstring#

    Comma-separated fields to sort by: started_at, created_at, updated_at or completed_at. Prefix a field with - for descending. Defaults to -started_at, newest first. Sessions not yet completed sort after completed ones by completed_at. The session id is always the final tiebreak.

  • filter[flow_id]string (uuid)#

    Only sessions of this flow. Takes [in] and [not_in] with a comma-separated list. This or filter[user_id] is required.

  • filter[user_id]string (uuid)#

    Only sessions of this user. Takes [in] and [not_in] with a comma-separated list. A user outside your organisation, or a service user, matches nothing. This or filter[flow_id] is required.

  • filter[status]string#

    Only sessions in this status: in_progress, completed or expired. Takes [in] and [not_in] with a comma-separated list.

    One of: in_progress, completed, expired
  • filter[flow_test]boolean#

    Only test runs of the flow when true, only real sessions when false.

  • filter[q]string#

    Sessions whose user's name contains this text, ignoring case.

  • filter[started_at]string#

    Only sessions started in a range, written filter[started_at][gte]=2026-10-01. Takes gt, gte, lt and lte.

  • filter[completed_at]string#

    Only sessions completed in a range, written filter[completed_at][gte]=2026-10-01. Takes gt, gte, lt and lte.

Responses

200

One page of onboarding sessions.

OnboardingSession[]
{
  "data": [
    {
      "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
      "flow_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
      "user_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
      "status": "in_progress",
      "flow_test": true,
      "started_at": "2026-06-12T10:00:00+00:00",
      "completed_at": "2026-06-12T10:00:00+00:00",
      "verification": {
        "verified_by_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
        "note": "string",
        "verified_at": "2026-06-12T10:00:00+00:00"
      },
      "flow": {
        "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
        "name": "string",
        "status": "draft",
        "expiry_type": "daily",
        "mode_type": "continuous",
        "user_types": [],
        "routes": [],
        "definition": {},
        "form_count": 1,
        "start_form_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
        "created_at": "2026-06-12T10:00:00+00:00",
        "updated_at": "2026-06-12T10:00:00+00:00"
      },
      "created_at": "2026-06-12T10:00:00+00:00",
      "updated_at": "2026-06-12T10:00:00+00:00"
    }
  ],
  "meta": {
    "limit": 1,
    "next_cursor": "string",
    "prev_cursor": "string"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl https://your-org-domain/kong/core/api/v2/onboarding-sessions\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"