Sign out one device
End a single sign-in, leaving the others alone — IN-335. The case `revoke-all` cannot serve: a member who left a laptop somewhere wants that one cut off, not to be signed out of the machine they are asking from. Two things have to happen and only one of them is obvious. Deleting the session record takes it off this list; **it does not sign anybody out**, because nothing on the request path consults these records. What stops the device is `TokenService.revoke_session`, which denies the token's `sid` — and reaches the refresh token too, since it carries the same claim. Without that second step this endpoint would report success and leave the device working, which is the failure `revoke_all_user_sessions` was written to stop repeating. 404 for a session that is not this member's. The Redis key is `session:{user_id}:{session_id}`, so a caller can only ever name their own; the lookup is what turns someone else's id into "not found" rather than a silent no-op that looks like success.
End a single sign-in, leaving the others alone — IN-335.
The case revoke-all cannot serve: a member who left a laptop somewhere
wants that one cut off, not to be signed out of the machine they are
asking from.
Two things have to happen and only one of them is obvious. Deleting the
session record takes it off this list; it does not sign anybody out,
because nothing on the request path consults these records. What stops
the device is TokenService.revoke_session, which denies the token's
sid — and reaches the refresh token too, since it carries the same
claim. Without that second step this endpoint would report success and
leave the device working, which is the failure revoke_all_user_sessions
was written to stop repeating.
404 for a session that is not this member's. The Redis key is
session:{user_id}:{session_id}, so a caller can only ever name their
own; the lookup is what turns someone else's id into "not found" rather
than a silent no-op that looks like success.
Authorization
OAuth2PasswordBearer In: header
Path Parameters
Cookie Parameters
Response Body
application/json
application/json
curl -X DELETE "https://example.com/api/b/v1/sessions/string"{ "revoked": true, "scope": "string"}Sign out of this business everywhere POST
End every session this member holds for this business. Takes effect on the next request rather than after some delay: every token issued before this moment is refused, including the refresh tokens that would otherwise keep minting access tokens for days.
Your authenticator status GET
Whether this member has an authenticator, and how much rope is left. `enrolled` without `active` means a setup was started and never confirmed — the screen should offer to finish it rather than to start again, because starting again issues a new secret and invalidates the QR code already on screen. `recovery_codes_remaining` is here because running out and *then* losing the phone is the one state nobody can recover from unaided, and a member cannot be warned about a number they are never shown.