When looking in the XUI at the API descriptor under the "/sessions" section, I can see that (for example) there is
The first describes a path parameter called "tokenId" which it says is "required". The second describes a path parameter called "userToken" which it also says is "required". In fact these are one and the same parameter and these are one and the same endpoint. This is presumably the same for all these other endpoints action_deleteproperty, actiongetidle, action_getmaxidle, etc. etc.