I want to convert a ory_kratos_session cookie to a sessionID so I can call GetSession(). it seems the only way to do this is using the frontendApi (and thus I need access to the kratos public TCP port), it cannot be done from the identityApi (and the admin TCP port). Is this correct or have I missed a trick? Its not a major problem, it just feels... well, strange.

Yea, that is correct. It does feel a bit round-trippy, but its the separation of concerns: cookie validation is a public/frontend concern (it involves CSRF, session cookies, and browser security semantics), while session management by ID is an administrative concern. The admin API deliberately doesn't parse or trust raw session cookies; that logic lives on the public side. If your use case is purely server-side, note that calling

/sessions/whoami

server-side by forwarding the cookie header is perfectly valid and doesn't require a browser, it just needs network access to the public port.

great, thanks The the separation makes sense when you put it in terms of trust.