Cut a principal off immediately: revoke every one of its live sessions.

DELETE

/admin/principals/{id}/sessions

curl --request DELETE \
  --url http://localhost:3001/admin/principals/00000000-0000-0000-0000-000000000000/sessions \
  --header 'Authorization: Bearer <token>'

import requests

url = "http://localhost:3001/admin/principals/00000000-0000-0000-0000-000000000000/sessions"

headers = {"Authorization": "Bearer <token>"}

response = requests.delete(url, headers=headers)

print(response.json())

use std::str::FromStr;
use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "http://localhost:3001/admin/principals/00000000-0000-0000-0000-000000000000/sessions";

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.request(reqwest::Method::from_str("DELETE").unwrap(), url)
        .headers(headers)
        .send()
        .await;

    let results = response.unwrap()
        .json::<serde_json::Value>()
        .await
        .unwrap();

    dbg!(results);
}

Effective on the very next request from any of them — lookup_session only resolves a session while revoked_at IS NULL, so there is nothing to invalidate beyond the row itself (no cache sits in front of it).

Authorizations

bearer_token

Parameters

Path Parameters

required

string format: uuid

Principal ID

Responses

200

application/json

How many of a principal’s sessions were just revoked.

Not itself proof the principal has no other way in — a revoked session only stops resolving on its next lookup_session (see sessions::lookup_session’s revoked_at IS NULL filter); this endpoint does not touch API keys.

object

revoked