Skip to main content

RevokeUserSessions

POST 
/v1/users/:user_id/revoke-sessions

RevokeUserSessions signs a user out everywhere by deleting every authn.session row they hold. It touches nothing else: API keys stay live and the account is not banned. This is the valet-native equivalent of fraser-auth's better-auth admin revoke-user-sessions endpoint, which the admin console calls when it lowers a user's role so the old role's sessions do not outlive the change. Revoking your own sessions is allowed, as it is on fraser-auth.

Same caller contract as BanUser: an interactive session that holds the admin scope, or the users.edit permission on a platform-scope RBAC binding. users.edit is the atom fraser-auth authorizes its own revoke-user-sessions endpoint on (the same gate as its ban endpoints), so valet and fraser-auth admit the same administrators. The request names a bare user_id and no tenant, so users.edit is authorized at PLATFORM reach, and the handler refuses any credential that is not a session, even an API key carrying users.edit.

NOT_FOUND for an unknown user_id. A known user with no sessions succeeds with revoked_count 0.

Request​

Responses​

Success