Revokes every session belonging to the caller except the calling
one. Signing out the current session is POST /api/v1/auth/logout,
which owns cookie expiry.
Revocation is authoritative outside API process memory and is
enforced immediately across every instance. One session.revoked
event is recorded for each session whose state actually changes, in
that session's own Workspace; if any event cannot be recorded, every
revocation in the request rolls back. Repeating the call revokes
nothing further and reports zero.
Requires authentication within the last 15 minutes.
Header Parameters
X-CSRF-TokenRequired
string·min 43·max 43
Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
Responses
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
revoked_countRequired
integer·min 0
Sessions whose state actually changed. A repeated call reports
zero rather than failing.
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
errorRequired
object
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
Retry-After
integer·min 1
Seconds until the client may retry.
errorRequired
object
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
Retry-After
integer·min 0
Delay in seconds before retrying, when an expected maintenance end is known.
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
