Revoke every session of an account for the calling application.

POST

/revoke-all

curl --request POST \
  --url https://session-api.sudomimus.com/revoke-all \
  --header 'Content-Type: application/json' \
  --data '{ "subject": "example" }'

• Production

Revokes all sessions for the supplied application-visible subject under the calling application. Sessions under other applications are not affected. The request requires a client-auth JWT with audience sudomimus-session. Unknown and out-of-scope subjects return the same revoked: true acknowledgement. Each signed request is single-use; a transport retry requires a freshly signed JWT with a new jti.

Authorizations

• SudomimusClientJWT

Request Body^required

Media typeapplication/json

object

subject

required

Application-visible sector subject (sub) for the account to revoke.

string

Example^generated

{
  "subject": "example"
}

Responses

200

Authority-safe revocation acknowledgement.

Media typeapplication/json

object

revoked

required

Authority-safe acknowledgement of the revocation request.

boolean

Example

{
  "revoked": true
}

401

Client-auth JWT missing, malformed, expired, invalid, or replayed. A retry after an uncertain response must use a freshly signed JWT with a new jti.

Media typeapplication/json

Error response body. A missing, malformed, or structurally invalid JSON request body returns InvalidBody. Documented status-only failures have an empty response body.

object

reason

required

string

message

string

Example^generated

{
  "reason": "example",
  "message": "example"
}

default

Error response.

Media typeapplication/json

Error response body. A missing, malformed, or structurally invalid JSON request body returns InvalidBody. Documented status-only failures have an empty response body.

object

reason

required

string

message

string

Example^generated

{
  "reason": "example",
  "message": "example"
}