Session Expiry Calculator

identity.session_expiry_calculate

ProductionBounded custom (Class B)Deterministicstrictinstantv1.0.0

No network

Overview

You send issuedAt, now, idleTimeoutSeconds and absoluteTimeoutSeconds. Optional lastActivityAt defaults to issuedAt. Optional clockSkewSeconds defaults to 0 and is added to now so expiry is fail-closed. Durations are 1 through 31,536,000 seconds. This does not read a session store, refresh a token or use a server clock.

A session that ignores the earlier of idle and absolute timeouts stays valid past policy.

Reliability

now is caller-supplied; the wall clock is never read. SESSION_EXPIRY_INVALID — trigger: a malformed instant or activity outside [issuedAt, now]; retryable: no; next: send ISO-8601 instants in order.

Context footprint

Expiry instants and remaining seconds only. A successful call costs 1 execution credit.

When to use it

When issuedAt, now and both timeouts are already known.

When you need to read a session store or verify a token signature.

Scope

Note

Calculates idle and absolute session expiry from caller-supplied instants and durations.

Non-goals

Does not read a session store
Does not refresh tokens
Does not use a server clock

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

validation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input2 MB

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
issuedAt	string	Yes	ISO-8601 instant when the session was issued.
lastActivityAt	string	No	ISO-8601 last-activity instant. Omit it to use issuedAt.
now	string	Yes	ISO-8601 evaluation instant supplied by the caller.
idleTimeoutSeconds	integer	Yes	Idle timeout in seconds from 1 through 31536000.
absoluteTimeoutSeconds	integer	Yes	Absolute timeout in seconds from 1 through 31536000.
clockSkewSeconds	integer	No	Seconds added to now for fail-closed expiry. Omit it for 0.

Output schema

Field	Type	Required	Description
idleExpiryAt	string	Yes	ISO-8601 idle expiry instant.
absoluteExpiryAt	string	Yes	ISO-8601 absolute expiry instant.
effectiveExpiryAt	string	Yes	Earlier of idle and absolute expiry.
effectiveBound	string	Yes	IDLE or ABSOLUTE, whichever expires first.
expired	boolean	Yes	True when now plus skew is at or after effective expiry.
reason	string	Yes	IDLE, ABSOLUTE or NOT_EXPIRED.
remainingSeconds	integer	Yes	Seconds remaining until effective expiry, floored at zero.
clockSkewSeconds	integer	Yes	Applied skew in seconds.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"identity.session_expiry_calculate","input":{"issuedAt":"2026-08-27T00:00:00Z","now":"2026-08-27T00:01:00Z","idleTimeoutSeconds":600,"absoluteTimeoutSeconds":3600}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("identity.session_expiry_calculate", {"absoluteTimeoutSeconds":3600,"issuedAt":"2026-08-27T00:00:00Z","now":"2026-08-27T00:05:00Z","idleTimeoutSeconds":600});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.
SESSION_EXPIRY_INVALID	400	No	The request payload failed this skill's input validation.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not read a session store
Does not refresh tokens
Does not use a server clock
Looking up a live session
Verifying a JWT signature

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "identity.session_expiry_calculate",
  "input": {
    "absoluteTimeoutSeconds": 3600,
    "issuedAt": "2026-08-27T00:00:00Z",
    "now": "2026-08-27T00:05:00Z",
    "idleTimeoutSeconds": 600
  }
}

Examples

A 10-minute idle window still has five minutes left

Inputjson

{
  "absoluteTimeoutSeconds": 3600,
  "issuedAt": "2026-08-27T00:00:00Z",
  "now": "2026-08-27T00:05:00Z",
  "idleTimeoutSeconds": 600
}

Expected outputjson

{
  "clockSkewSeconds": 0,
  "remainingSeconds": 300,
  "idleExpiryAt": "2026-08-27T00:10:00Z",
  "absoluteExpiryAt": "2026-08-27T01:00:00Z",
  "effectiveExpiryAt": "2026-08-27T00:10:00Z",
  "reason": "NOT_EXPIRED",
  "expired": false,
  "effectiveBound": "IDLE"
}

Tip

effectiveBound is IDLE and expired is false.

now equal to absolute expiry is expired