Revoke Session
End a single active session. The session is marked revoked, and its token is rejected on later requests. Use this to log out a client from one specific device without affecting their other sessions (e.g. user reports a stolen laptop).
Revoking a session that doesn't exist for this endpoint/client (already revoked, expired-and-pruned, or not yours) returns 404 — this call is not idempotent. To kill every active session for a client, use POST .../sessions/revoke-all.
Path parameters
uuid from /endpoints.uuid. Resolved under this endpoint only.uuid from list sessions. Resolved under this client only.Deprecated: legacy integer ids are still accepted in the path until the sunset, answered with Deprecation and Sunset headers. Use the uuids.
Request body
None — empty body or {}.
Response (200 OK)
"Session revoked successfully".Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
integer_id_unsupported).endpoints:delete permission in the active account.endpoint not found), the client isn't a client of this endpoint (client not found), or no matching active session exists for this client (session not found).