Session commands

Common global behavior is documented in the CLI hub. The complete session-management command contracts follow.

gdsgate session list

Lists the live sessions you are permitted to terminate (filtered by the Cedar killSession action).

Columns: id, owner, resource, kind, src ip, started, holds. --wide adds serial, the access certificate the session was opened with. --json prints one object per session.

holds is what the session was opened with:

holds	Session	After session kill
key	Holder proved possession of a key.	The holder keeps the certificate.
cookie	Opened through the clientless browser entry.	Access ends until the person signs in again.

gdsgate --config client.toml session list
# id        owner  resource  kind      src ip     started              holds
# 5f3c1234  alice  prod-db   postgres  10.0.0.14  2026-09-21 09:12:40  key

gdsgate session kill [<id>] [--principal <p>] [--resource <r>]

Terminates live sessions and audits each one. Pass one selector: <id>, --principal or --resource. Only sessions the policy permits are ended.

SESSION_ID=5f3c1234  # replace with an id from `session list`
gdsgate --config client.toml session kill "$SESSION_ID"
gdsgate --config client.toml session kill --principal alice
gdsgate --config client.toml session kill --resource prod-db

Argument	Default	Purpose
<id>	none	A single session id. Mutually exclusive with the selectors below.
--principal <p>	none	Every live session owned by this principal.
--resource <r>	none	Every live session on this backend resource.

gdsgate session watch

Streams opens and closes of live sessions you may act on, until interrupted.

list kill watch