Skip to content
Sudomimus

Session API Overview

Application session lifecycle API.

Sudomimus Session 4.1.0

Section titled “Sudomimus Session 4.1.0”

Use the Session API to verify application tokens, rotate refresh tokens, inspect live session authority, retrieve current shared identity data, and revoke sessions created through Connect, Device, or Native flows. It accepts ordinary application access tokens and dedicated Workload access tokens carrying pairwise act.sub; both resolve to the owner Account’s existing claim-sharing authority.

Information

  • License: MIT
  • OpenAPI version: 3.1.0

Operations

Section titled “Operations”
GET
/health
GET
/applications/{applicationAnchor}/jwks.json
POST
/refresh
POST
/introspect
GET
/userinfo
GET
/claim-state
POST
/logout
POST
/revoke-all

Authentication

Section titled “Authentication”

BearerAccessToken

Section titled “BearerAccessToken”

Ordinary Sudomimus application access token.

Security scheme type: http

Bearer format: JWT

SudomimusClientJWT

Section titled “SudomimusClientJWT”

Client-auth JWT carried via Authorization: SudomimusClientJWT <jwt>. For Session API /revoke-all, the aud claim MUST be the literal string "sudomimus-session". The JWT is RS256-signed with the application’s client-auth private key and carries iss, iat, exp, jti, and body_sha256 exactly like Connect /establish. Each jti is accepted only once for /revoke-all.

Security scheme type: http