Revoke All Sessions
End every active session for a client at once. The "panic button" — kicks the user off every device they're logged in on. Combine with PUT .../status with "disabled" or "revoked" if you also want to block future logins.
Use cases:
- Lost device — kick all sessions in case the laptop is unlocked.
- Suspected credential leak — invalidate everything before rotating.
- Offboarding — when removing a user, revoke all + suspend before delete.
Every active session is marked revoked, and their tokens are rejected on later requests. New logins still work unless the client is also suspended.
Path parameters
uuid string (uuid) Req
The endpoint's
uuid from /endpoints.client_uuid string (uuid) Req
The RBAC client's
uuid. Resolved under this endpoint only.Deprecated: the legacy integer id is still accepted in the path until the sunset, answered with Deprecation and Sunset headers. Use the uuid.
Request body
None.
Response (200 OK)
A confirmation object — note there is no revoked-count field.
endpoint_uuid, client_uuid string (uuid)
Echo of the target endpoint and client.
message string
"All sessions revoked successfully".Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
400 Bad Request
An integer client id after the sunset (
integer_id_unsupported).401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks the
endpoints:delete permission in the active account.404 Not Found
Endpoint doesn't exist or doesn't belong to the calling account, or the client isn't a client of this endpoint (
client not found).Request
curl -X POST \
"https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/clients/019b4b9d-d300-736b-8601-153b3d9f70ee/sessions/revoke-all" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json"
Python — offboard a user
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
ep, client_uuid = "019bb1e4-e785-77d2-9966-c3cff31d0a0e", "019b4b9d-d300-736b-8601-153b3d9f70ee"
# 1. Disable so future logins fail
client._put_raw(
f"/endpoints/{ep}/rbac/clients/{client_uuid}/status",
{"status": "disabled"},
)
# 2. Revoke all active sessions
result = client._post_raw(
f"/endpoints/{ep}/rbac/clients/{client_uuid}/sessions/revoke-all", {},
)
print(result["message"])
Response — 200 OK
{
"endpoint_uuid": "019bb1e4-e785-77d2-9966-c3cff31d0a0e",
"client_uuid": "019b4b9d-d300-736b-8601-153b3d9f70ee",
"message": "All sessions revoked successfully"
}
Was this helpful?