diff --git a/CHANGELOG.md b/CHANGELOG.md
index 384071a..5256c7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- `QueryRunInfo::user_public_id` now reports the caller's stable account id (the
+  access token's subject) instead of a fingerprint of the bearer token, which
+  churned every few minutes as short-lived JWTs were reminted. Grouping a
+  caller's query history by this field now holds across token refreshes. A
+  request that carries no verified subject still records an opaque
+  `user_`-prefixed fingerprint — stable for that credential, but not resolvable
+  to an account. This is a server-side change; the SDK only carries the field.
 - feat(databases): add search parameter to list endpoint
 
 ## [0.10.0] - 2026-07-23
diff --git a/docs/QueryApi.md b/docs/QueryApi.md
index 7075a0c..ec7e9ab 100644
--- a/docs/QueryApi.md
+++ b/docs/QueryApi.md
@@ -29,7 +29,7 @@ Name | Type | Description  | Required | Notes
 
 ### Authorization
 
-[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth)
+[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth)
 
 ### HTTP request headers
 
diff --git a/docs/QueryRunInfo.md b/docs/QueryRunInfo.md
index 567c426..1b925a4 100644
--- a/docs/QueryRunInfo.md
+++ b/docs/QueryRunInfo.md
@@ -21,7 +21,7 @@ Name | Type | Description | Notes
 **sql_text** | **String** |  | 
 **status** | **String** |  | 
 **trace_id** | Option<**String**> |  | [optional]
-**user_public_id** | Option<**String**> | Caller identity derived from the Authorization Bearer token (SHA-256 hash). Format: `user_{first_10_hex_chars}`. | [optional]
+**user_public_id** | Option<**String**> | Who ran this query: the account id from the access token the request was made with. Use it to group a caller's query history.  Requests made with a credential that identifies no account instead record an opaque `user_`-prefixed identifier, which is stable for that credential but cannot be resolved to an account. | [optional]
 **warning_message** | Option<**String**> |  | [optional]
 
 [[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
diff --git a/docs/ResultsApi.md b/docs/ResultsApi.md
index aadf961..ec449a3 100644
--- a/docs/ResultsApi.md
+++ b/docs/ResultsApi.md
@@ -33,7 +33,7 @@ Name | Type | Description  | Required | Notes
 
 ### Authorization
 
-[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth)
+[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth)
 
 ### HTTP request headers
 
@@ -65,7 +65,7 @@ Name | Type | Description  | Required | Notes
 
 ### Authorization
 
-[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth)
+[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth)
 
 ### HTTP request headers
 
diff --git a/src/apis/query_api.rs b/src/apis/query_api.rs
index 6196aa5..03437e3 100644
--- a/src/apis/query_api.rs
+++ b/src/apis/query_api.rs
@@ -54,14 +54,6 @@ pub async fn query(
         };
         req_builder = req_builder.header("X-Workspace-Id", value);
     };
-    if let Some(apikey) = configuration.api_keys.get("X-Session-Id") {
-        let key = apikey.key.clone();
-        let value = match apikey.prefix {
-            Some(ref prefix) => format!("{} {}", prefix, key),
-            None => key,
-        };
-        req_builder = req_builder.header("X-Session-Id", value);
-    };
     if let Some(token) = configuration.resolve_bearer_token().await {
         req_builder = req_builder.bearer_auth(token);
     };
diff --git a/src/apis/results_api.rs b/src/apis/results_api.rs
index 1442c3d..db33452 100644
--- a/src/apis/results_api.rs
+++ b/src/apis/results_api.rs
@@ -76,14 +76,6 @@ pub async fn get_result(
         };
         req_builder = req_builder.header("X-Workspace-Id", value);
     };
-    if let Some(apikey) = configuration.api_keys.get("X-Session-Id") {
-        let key = apikey.key.clone();
-        let value = match apikey.prefix {
-            Some(ref prefix) => format!("{} {}", prefix, key),
-            None => key,
-        };
-        req_builder = req_builder.header("X-Session-Id", value);
-    };
     if let Some(token) = configuration.resolve_bearer_token().await {
         req_builder = req_builder.bearer_auth(token);
     };
@@ -158,14 +150,6 @@ pub async fn list_results(
         };
         req_builder = req_builder.header("X-Workspace-Id", value);
     };
-    if let Some(apikey) = configuration.api_keys.get("X-Session-Id") {
-        let key = apikey.key.clone();
-        let value = match apikey.prefix {
-            Some(ref prefix) => format!("{} {}", prefix, key),
-            None => key,
-        };
-        req_builder = req_builder.header("X-Session-Id", value);
-    };
     if let Some(token) = configuration.resolve_bearer_token().await {
         req_builder = req_builder.bearer_auth(token);
     };
diff --git a/src/models/query_run_info.rs b/src/models/query_run_info.rs
index 1562301..80d7c73 100644
--- a/src/models/query_run_info.rs
+++ b/src/models/query_run_info.rs
@@ -106,7 +106,7 @@ pub struct QueryRunInfo {
         skip_serializing_if = "Option::is_none"
     )]
     pub trace_id: Option<Option<String>>,
-    /// Caller identity derived from the Authorization Bearer token (SHA-256 hash). Format: `user_{first_10_hex_chars}`.
+    /// Who ran this query: the account id from the access token the request was made with. Use it to group a caller's query history.  Requests made with a credential that identifies no account instead record an opaque `user_`-prefixed identifier, which is stable for that credential but cannot be resolved to an account.
     #[serde(
         rename = "user_public_id",
         default,