Sign out of this business everywhere
End every session this member holds for this business. Takes effect on the next request rather than after some delay: every token issued before this moment is refused, including the refresh tokens that would otherwise keep minting access tokens for days.
End every session this member holds for this business.
Takes effect on the next request rather than after some delay: every token issued before this moment is refused, including the refresh tokens that would otherwise keep minting access tokens for days.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Response Body
application/json
application/json
curl -X POST "https://example.com/api/b/v1/sessions/revoke-all"{ "revoked": true, "scope": "string"}List your active sessions GET
Previous Page
Sign out one device DELETE
End a single sign-in, leaving the others alone — IN-335. The case `revoke-all` cannot serve: a member who left a laptop somewhere wants that one cut off, not to be signed out of the machine they are asking from. Two things have to happen and only one of them is obvious. Deleting the session record takes it off this list; **it does not sign anybody out**, because nothing on the request path consults these records. What stops the device is `TokenService.revoke_session`, which denies the token's `sid` — and reaches the refresh token too, since it carries the same claim. Without that second step this endpoint would report success and leave the device working, which is the failure `revoke_all_user_sessions` was written to stop repeating. 404 for a session that is not this member's. The Redis key is `session:{user_id}:{session_id}`, so a caller can only ever name their own; the lookup is what turns someone else's id into "not found" rather than a silent no-op that looks like success.