Revoke session

Developing

DELETE

/sessions/{session_id}

Terminates a specific authenticated session associated with the current user. This endpoint invalidates the specified session, preventing any further use of its access and refresh tokens. It is primarily used to remotely sign out from a specific device or browser while keeping other active sessions unaffected.

Users may only revoke sessions that belong to their own account. If the targeted session is the current session, the user is immediately logged out and must authenticate again to continue using protected resources.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Path Params

Responses

🟢200Success

application/json

Bodyapplication/json

🟠400Validation Error

🟠401Token Missing

🟠401Invalid Token

🟠401Token Expired

🟠403Account Not Exists

🟠403Account Soft Deleted

🟠403Account Deactivated

🟠403Account Locked

🟠403Account Not Verified

🟠401Session Not Found

🟠401Session Revoked

🟠401Session Expired

🟠403Forbidden

🟠404Session Not Found

🟠429Rate Limit Exceeded

🔴500Internal Server Error

Request Example

Shell

JavaScript

Java

Swift

curl --location --request DELETE 'http://localhost:3000/api/v1/sessions/' \
--header 'Authorization: Bearer <token>'

Response Example

200 - Example

{
    "status": "success",
    "message": "Session revoked successfully.",
    "data": {
        "session_id": "a56dec9cb26501f8b1bf2dbf5863bd7519e205db",
        "revoked_at": "2026-07-18T20:45:41.385Z"
    }
}

Modified at 2026-07-18 20:08:09

Get all sessions

Revoke all sessions