2026-07-27 — Session list and TOTP URI fixes

Listing your sessions no longer fails; TOTP setup URI is POST with your password.

Session list

GET /v1/api/user/list/sessions no longer returns a server error when you are signed in. You get your active sessions (device, browser, IP, country when available).

Call it with a valid session (Bearer token or cookie). Without auth you get 401, not a crash.

TOTP setup URI

Fetching the authenticator QR URI is POST, not GET:

POST /v1/api/user/two/factor/get/totp/uri

Body:

{ "password": "your-account-password" }

Include your session. GET on that path correctly returns 404 because the route only accepts POST.