Overview

Application session lifecycle API.

Sudomimus Session 4.0.0

Use the Session API to verify application tokens, rotate refresh tokens, inspect live session authority, retrieve current shared identity data, and revoke sessions created through Connect, Device, or Native flows.

Information

License: MIT
OpenAPI version: 3.1.0

Authentication

BearerAccessToken

Ordinary Sudomimus application access token.

Security scheme type: http

Bearer format: JWT

SudomimusClientJWT

Client-auth JWT carried via Authorization: SudomimusClientJWT <jwt>. For Session API /revoke-all, the aud claim MUST be the literal string "sudomimus-session". The JWT is RS256-signed with the application’s client-auth private key and carries iss, iat, exp, jti, and body_sha256 exactly like Connect /establish. Each jti is accepted only once for /revoke-all.