Skip to main content

RevokeUserSessions

POST 
/v1/users/:user_id/revoke-sessions

RevokeUserSessions signs a user out everywhere by deleting every authn.session row they hold. It touches nothing else: API keys stay live and the account is not banned. Calling it after lowering a user's role keeps the old role's sessions from outliving the change. A caller may revoke their own sessions.

Same caller contract as BanUser: an interactive session that holds the admin scope, or the users.edit permission on a platform-scope RBAC binding. The request names a bare user_id and no tenant, so users.edit is authorized at PLATFORM reach, and the handler refuses any credential that is not a session, even an API key carrying users.edit.

NOT_FOUND for an unknown user_id. A known user with no sessions succeeds with revoked_count 0.

Request​

Responses​

Success