Account security

Current release · Updated October 2, 2026

DryKraft account security API: methods, permissions, request fields, response shapes, examples and current limits. Read authentication and error handling first.

GET/api/account/security

Read account security

Access: Account session · Success: 200

Across all workspaces. 25 other sessions per page plus current session and latest 20 private security events. Browser labels are approximate, activity updates about every five minutes.

Query parameters

Parameter	Type	Required	Details
`cursor`	uuid	No

No request body is required.

Response

Field	Type	Required	Details
`current`	object	No	id, device, created_at, last_seen_at, expires_at
`others`	object	No	items, total, next_cursor
`password_changed_at`	string or null	No
`shared_demo`	boolean	No	Shared sample
`history`	object[]	No

Request shape (illustrative)

curl --request GET \
  --url 'https://app.drykraft.com/api/account/security' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>'

DELETE/api/account/sessions

End other sessions

Access: Account session · Success: 200

Keeps this session and revokes all other active sessions across workspaces.

No request body is required.

Response

Field	Type	Required	Details
`count`	integer	No	Sessions ended

Request shape (illustrative)

curl --request DELETE \
  --url 'https://app.drykraft.com/api/account/sessions' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>'

DELETE/api/account/sessions/{id}

End a session

Access: Account session · Success: 200

Ending this session clears its cookie. Missing/already-ended session returns 404.

No request body is required.

Response

Field	Type	Required	Details
`current`	boolean	No	Whether this session ended

Request shape (illustrative)

curl --request DELETE \
  --url 'https://app.drykraft.com/api/account/sessions/00000000-0000-4000-8000-000000000001' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>'

POST/api/account/password

Change password

Access: Account session · Success: 200

Current password is required; new and confirmation must match and differ from current. Rotates this session, ends all others. Shared sample account is blocked. 10 attempts per account per 15 minutes.

JSON request

Field	Type	Required	Details
`current_password`	string	Yes	Max 128 characters.
`new_password`	string	Yes	Max 128 characters.
`confirm_password`	string	Yes	Max 128 characters.

Response

Use OK.

Request shape (illustrative)

curl --request POST \
  --url 'https://app.drykraft.com/api/account/password' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "current_password": "<value>",
  "new_password": "<value>",
  "confirm_password": "<value>"
}'