---
title: "Invalidate user sessions"
method: POST
path: "/api/security/session/_invalidate"
tags: ["user session"]
---

# Invalidate user sessions

`POST /api/security/session/_invalidate`

Invalidate user sessions that match a query. To use this API, you must be a superuser.

## Headers

- `kbn-xsrf` string, required

## Request body

- object
  - `match` 'all' | 'query', required — The method Kibana uses to determine which sessions to invalidate. If it is `all`, all existing sessions will be invalidated. If it is `query`, only the sessions that match the query will be invalidated.
  - `query` object — The query that Kibana uses to match the sessions to invalidate when the `match` parameter is set to `query`.
    - `provider` object, required — The authentication providers that will have their user sessions invalidated.
      - `name` string — The authentication provider name.
      - `type` string, required — The authentication provide type. For example: `basic`, `token`, `saml`, `oidc`, `kerberos`, or `pki`.
    - `username` string — The username that will have its sessions invalidated.

## Response `200`

Indicates a successful call

- object
  - `total` integer — The number of sessions that were successfully invalidated.

## Other responses

- `403` — Indicates that the user may not be authorized to invalidate sessions for other users.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)