Revoke a session
POST /v1/sessions/{session_id}:revoke · permission sessions:write
Revokes the session and the refresh token families bound to it; access tokens issued in the session stop being accepted by introspection and the revocation check (sid), and the session's applications receive logout notifications. The request has no body. Revoking a session that is already revoked or expired changes nothing and returns already_inactive: true. The revocation is written to the management audit log. Send an Idempotency-Key header to make retries safe.
Request
| Parameter | In | Required | Description |
|---|---|---|---|
session_id |
path | yes | Session id, prefixed ses_. |
Response
200 OK.
{
"already_inactive": false,
"revoked_token_families": 2
}
Errors
Every error is an application/problem+json body with a stable code.
| HTTP | code |
When |
|---|---|---|
| 400 | malformed_request, unknown_field |
A body was sent that is not valid JSON or has a field. |
| 404 | not_found |
The session does not exist in this environment (or the id is malformed). |
| 401 | unauthenticated |
The API key is missing, invalid or revoked. |
| 403 | insufficient_permissions |
The key lacks the sessions:write permission. |
| 429 | rate_limited |
The rate limit was exceeded; honor Retry-After. |
| 503 | service_unavailable |
A dependency is temporarily unavailable; retry later. |
Example
curl -X POST https://api.eu.keenauth.com/v1/sessions/ses_0a1b2c3d4e5f6g7h8j9k0m1n2p:revoke \
-H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
-H "Idempotency-Key: $(uuidgen)"
CLI: keenauth sessions revoke ses_0a1b2c3d4e5f6g7h8j9k0m1n2p --yes