REST API and API keys
Access your Sessional data programmatically and integrate with external tools.
What the API provides
The Sessional REST API gives you read access to your core data, so you can build custom integrations, generate reports in external tools, or feed data into your own workflows.
Common uses include pulling invoice data into a spreadsheet, syncing session history with a calendar, feeding expense data into bookkeeping software, and automating monthly reports for your accountant.
Creating an API key
To create a new API key:
- Navigate to API settings from your dashboard.
- Click Create API key and give the key a descriptive name.
- Copy the key once at creation time and store it securely.
API keys use the prefix sk_live_ followed by a random string.
Authentication
All API requests must include your key in the Authorization header using the Bearer scheme.
GET /api/v1/sessions HTTP/1.1
Host: sessional.co.uk
Authorization: Bearer sk_live_your_key_hereRequests without a valid key, or with an expired or revoked key, receive a 401 Unauthorized response.
Rate limits
To protect the platform and ensure fair usage, the API enforces a rate limit of 100 requests per minute per user. This is a sliding window: each request is counted against the previous 60 seconds.
If you exceed the limit, the API returns a 429 Too Many Requests response with a Retry-After header.
Available endpoints
List your bookings with filters for date range, status, and organisation.
List your invoices with filters for status and date range.
List your expenses with filters for category and date range.
Retrieve your profile information including name, profession, and contact details.
All list endpoints support pagination via page and per_page query parameters. The default page size is 25, with a maximum of 100.
Interactive documentation
The API documentation page at Dashboard > API includes an interactive try-it feature. Select an endpoint, fill in optional parameters, and click Send to see the live response from your account.
The documentation also shows the full JSON schema for each endpoint's response, including all available filter parameters.
Revoking an API key
If you no longer need a key, or if it may have been exposed, revoke it from the API settings page. Revocation is immediate: any requests using that key will start returning 401 Unauthorized straight away.
You can create a new key at any time to replace a revoked one. There is no limit on the number of keys you can create, though we recommend keeping only active keys and revoking those you no longer use.
Frequently asked questions
Can I use the API to create or update data?
The API currently provides read-only access. You cannot create, update, or delete records through the API. All data entry is done through the Sessional dashboard.
What happens if I downgrade from Pro?
Your API keys are retained but become inactive. Any API requests will return 403 Forbidden until you upgrade back to Pro. Your keys do not need to be recreated: they reactivate automatically when your Pro subscription resumes.
Can I have multiple API keys?
Yes. You can create as many keys as you need. This is useful if you use separate integrations and want to be able to revoke access to one without affecting others.
Is there a webhook or push API?
Not at present. The API is pull-based: your application requests data when it needs it. If you need real-time updates, consider polling at a sensible interval.
How do I report a bug or request a new endpoint?
Submit a support ticket from Dashboard > Support with details of what you need. We review all API feedback and prioritise based on demand.