Read the result of a sajn Login session
Authoritative read of a login session. Call this from your server after the redirect.
claims and sub are populated only once status is COMPLETED, and contain exactly the fields your client is approved for — the same projection the OIDC id_token uses.
sub is stable per person per organization: the same individual logging into any of your clients always yields the same sub, and it can never be correlated with their identifier at another sajn customer.
Authorizations
Personal API key, e.g. Authorization: Bearer sajn_sk_.... Not scope-limited — acts as the issuing user.
Headers
API version for this request. Without it, the request uses the organization's default version; an organization without a default is pinned to the latest version by its first request.
2026-09, 2026-10 ID of the workspace this request acts in, from GET /api/v1/workspaces. Without it, an API key acts in its default workspace. The token's user must be a member of the workspace; an OAuth token only accepts the workspace it was granted for. A workspace that doesn't exist or can't be reached returns 403 WORKSPACE_ACCESS_DENIED.
Path Parameters
The sajn Login session ID.
Response
200
The sajn Login session ID.
PENDING, COMPLETED, FAILED, EXPIRED The eID the user authenticated with, such as SE_BANKID. Null until status is COMPLETED.
SE_BANKID, NO_BANKID_BIOMETRIC, NO_BANKID_HIGH, NO_QES, DK_MITID, DK_MITID_ERHVERV, FI_FTN, NL_IDIN, ZEALID_QES, null The claims your client is approved for. A claim it isn't approved for is null.
Open this in a browser or an in-app browser to authenticate the user. Set only in the response to the create request; null otherwise.
When the user must have authenticated by. Set only in the response to the create request; null otherwise.

