> ## Documentation Index > Fetch the complete documentation index at: https://docs.gominerva.com/llms.txt > Use this file to discover all available pages before exploring further. # List sessions > Scope-filtered management list, newest first: the dashboard profile-tab feed. Application Api-Key OR any resolved in-scope dashboard user (member+). ## OpenAPI ````yaml /api-reference/idv-svc.json get /sessions openapi: 3.1.0 info: title: Minerva IDV API version: 1.0.0-draft description: >- Customer API for identity verification. Create verification sessions for profiles, deliver invites, track capture progress, and read review outcomes. For the end-to-end flow, see the [IDV Integration Guide](/api-reference/idv-integration-guide). Reviewer-safe responses never expose storage keys, checksums, wrapped keys, encryption context, raw OCR, or raw model output. Decrypted personal data is available only on `GET /sessions/{sessionId}/data`, to an authenticated in-scope principal, with fail-closed auditing. servers: - url: https://api.gominerva.com/idv/v1 description: The production API server for Minerva identity verification security: [] tags: - name: sessions description: >- Verification sessions and invite delivery (application or dashboard authentication). - name: capture description: End-user capture flow (session or invite credentials). - name: review description: Review decisions and audited structured-data access. - name: workflows description: Workflow configuration for verification sessions. - name: themes description: Branding themes and managed logo assets. paths: /sessions: get: tags: - sessions summary: List sessions description: > Scope-filtered management list, newest first: the dashboard profile-tab feed. Application Api-Key OR any resolved in-scope dashboard user (member+). parameters: - name: profile_id in: query required: false schema: type: string pattern: ^[A-Za-z0-9._:-]{1,128}$ description: >- Restrict to one profile's sessions (400 `idv_profile_id_invalid` on a malformed id). - name: review_status in: query required: false schema: type: string description: CSV of review statuses (400 on unknown values). - name: limit in: query required: false schema: type: integer minimum: 1 default: 50 description: Page size; hard cap 100 (larger values are clamped). responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/SessionListResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' security: - applicationApiKey: [] - dashboardUserToken: [] components: schemas: SessionListResponse: type: object required: - data properties: data: type: array description: Newest first, at most `limit` (cap 100) rows. items: $ref: '#/components/schemas/SessionSummary' SessionSummary: type: object description: Management list row (the dashboard profile-tab feed). required: - id - profile_id - status - review_status - flag_categories - created_at properties: id: type: string profile_id: type: string status: $ref: '#/components/schemas/SessionStatus' review_status: $ref: '#/components/schemas/ReviewStatus' flag_categories: type: array items: type: string enum: - idv - document - questionnaire assignee: type: string description: Current assignee user id; omitted when unassigned. workflow_ref: $ref: '#/components/schemas/WorkflowRef' theme_ref: $ref: '#/components/schemas/ThemeRef' created_at: type: string format: date-time submitted_at: type: string assessed_at: type: string reviewed_at: type: string Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string example: idv_session_not_found message: type: string SessionStatus: type: string description: > FLOW axis only since the status split: assessment outcomes live on `review_status` (the gate's recommendation stays on the assessment block) and `assessed` replaces the legacy conflated approved/rejected/requires_review terminal statuses. Terminal flow states are assessed, failed, canceled, deleted. enum: - collecting_artifacts - ready_for_assessment - queued - assessing - assessed - failed - canceled - deleted ReviewStatus: type: string description: > Human-review axis. Service-derived until a human decides: create -> request_sent; successful submit -> pending; assessment terminal -> automatic_pass ONLY for a clean pass (gate approved, zero fraud flags, zero error/critical quality issues), EVERYTHING else fail-closed to requires_review. Human transitions (management planes): requires_review and automatic_pass admit escalation|accepted|rejected; escalation admits accepted|rejected; accepted/rejected are terminal (further decisions -> 409 idv_review_terminal; other sources -> 409 idv_review_invalid_transition). enum: - request_sent - pending - requires_review - automatic_pass - escalation - rejected - accepted WorkflowRef: type: object description: Create-time snapshot of the workflow a session was built from. required: - workflow_id - name - revision properties: workflow_id: type: string name: type: string revision: type: integer minimum: 1 ThemeRef: type: object description: Create-time snapshot of the theme resolved for a session. required: - theme_id - name - revision properties: theme_id: type: string name: type: string revision: type: integer minimum: 1 responses: BadRequest: description: Validation error content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: >- Missing or invalid credentials (uniform for token plane, no existence oracle) content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: applicationApiKey: type: apiKey in: header name: Authorization description: >- `Authorization: Api-Key ` (legacy `X-Api-Key` also accepted). dashboardUserToken: type: apiKey in: header name: x-user-token description: > Dashboard session token for Minerva dashboard users. Management routes accept it alongside an application API key; any in-scope workspace user (member or above) can read sessions and record review decisions, while workflow and theme writes need a management-capable role. Send it with the `x-tenant-id` and `x-workspace-id` headers; a header/access mismatch is refused with 403, and when dashboard authentication is disabled (the default) any request carrying this header gets a uniform 401. ````