Skip to main content

RevokeUserSessions

POST 
/v1/users/:user_id/revoke-sessions

RevokeUserSessions signs a user out everywhere by deleting every authn.session row they hold. It touches nothing else: API keys stay live and the account is not banned. It replaced better-auth's admin revoke-user-sessions endpoint, and the admin console calls it when it lowers a user's role so the old role's sessions do not outlive the change. Revoking your own sessions is allowed.

Same caller contract as BanUser: an interactive session that holds the admin scope, or the users.edit permission on a platform-scope RBAC binding. users.edit is the atom the old revoke-user-sessions endpoint authorized on (the same gate as the ban endpoints), so the same administrators are admitted. The request names a bare user_id and no tenant, so users.edit is authorized at PLATFORM reach, and the handler refuses any credential that is not a session, even an API key carrying users.edit.

NOT_FOUND for an unknown user_id. A known user with no sessions succeeds with revoked_count 0.

Request​

Responses​

Success