---
title: "Update session"
method: PATCH
path: "/zones/{zoneId}/sessions/{id}"
tags: ["Sessions"]
---

# Update session

`PATCH /zones/{zoneId}/sessions/{id}`

Revokes an active session

## Path parameters

- `zoneId` string, required
- `id` string, required

## Request body

- object
  - `status` 'revoked', required

## Response `200`

An authenticated identity session. Sessions can be user sessions (representing end-user authentication) or application sessions (representing service-to-service authentication). User sessions support hierarchical relationships via parent_id, while application sessions are always standalone.

- union
  - object — User session type-specific fields
    - `id` string, required — Session ID
    - `organization_id` string, required — Organization that owns this session
    - `zone_id` string, required — Zone this session belongs to
    - `created_at` string, date-time, required — Entity creation timestamp
    - `authenticated_at` string, date-time — Date when the session was authenticated
    - `updated_at` string, date-time, required — Entity update timestamp
    - `expires_at` string, date-time, required — Date when session expires
    - `session_data` object — Session claims data (ID token claims for users, application claims for applications)
    - `metadata` object, required — Session metadata
      - `name` string, required — Name of the initiating application or user agent
    - `status` 'active' | 'expired' | 'revoked'
    - `active` boolean — Whether the session is currently active (deprecated - use status instead)
    - `session_type` 'user', required
    - `user_id` string, required — User ID
    - `application_id` string — Application ID that initiated this session
    - `user_agent_id` string — User agent ID (browser/client) that initiated this session
    - `user` IamUser — An authenticated user entity
      - `id` string, required — Unique identifier of the user
      - `organization_id` string, required — Organization that owns this user
      - `zone_id` string, required — Zone this user belongs to
      - `identifier` string, required — Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.
      - `subject` string — Subject identifier from the identity provider
      - `issuer` string — Issuer identifier of the identity provider
      - `email` string, email, required — Email address of the user
      - `email_verified` boolean, required — Whether the email address has been verified
      - `status` 'active' | 'disabled', required — Status of the user. Disabled users cannot authenticate.
      - `provider_id` string — Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
      - `authenticated_at` string — Date when the user was last authenticated
      - `session_count` integer — Session count for this user. Populated only when `expand[]=session_count` is set on the listing endpoint.
      - `grant_count` integer — Delegated-grant count for this user. Populated only when `expand[]=grant_count` is set on the listing endpoint.
      - `role_assignments` IamUserRoleAssignment[] — Role grants for this user within the zone. Populated only when `expand[]=role-assignments` is set on the listing endpoint.
        - `role_id` string, required — ID of the assigned role
        - `role_identifier` string, required — Opaque role identifier. Treated as an opaque identifier by the API and unique within a zone.
        - `scope` object, nullable, required — The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
          - `type` string, required — The kind of resource this grant is scoped to (e.g. `zone`).
          - `id` string, required — The ID of the scoped resource.
    - `application` IamApplication — An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
      - `id` string, required — Unique identifier of the application
      - `organization_id` string, required — Organization that owns this application
      - `zone_id` string, required — Zone this application belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `identifier` string, required — User specified identifier, unique within the zone
      - `name` string, required — Human-readable name
      - `description` string, nullable — Human-readable description
      - `metadata` IamMetadata — Entity metadata
        - `docs_url` string, uri — Documentation URL
        - `icon_url` string, uri — Icon URL
      - `protocols` object, nullable — Protocol-specific configuration
        - `oauth2` IamApplicationOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
          - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application
          - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application
      - `dependencies_count` integer, required — Number of resource dependencies
      - `owner_type` 'platform' | 'customer', required — Who owns this application. Platform-owned applications cannot be modified via API.
      - `consent` 'implicit' | 'required', required — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `user_agent` IamUserAgent — A User Agent represents a user agent (browser, desktop app, CLI tool) that can initiate user sessions via OAuth 2.0 Dynamic Client Registration.
      - `id` string, required — Unique identifier of the user agent
      - `organization_id` string, required — Organization that owns this user agent
      - `zone_id` string, required — Zone this user agent belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `identifier` string, required — User agent identifier (serves as OAuth client_id). Format: ua:{sha256_hash}
      - `name` string, required — Human-readable name
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `provider_id` string — Provider ID
    - `subject` string — Subject claim from IdP
    - `issuer` string, uri — Issuer URL from IdP
    - `parent_id` string — Parent session ID for hierarchical sessions (user sessions only). When null, this is a web session - a top-level session initiated directly by a user. When set, this is a child session derived from the parent, used for token refresh or delegation. Application sessions cannot have parents.
  - object — Application session type-specific fields
    - `id` string, required — Session ID
    - `organization_id` string, required — Organization that owns this session
    - `zone_id` string, required — Zone this session belongs to
    - `created_at` string, date-time, required — Entity creation timestamp
    - `authenticated_at` string, date-time — Date when the session was authenticated
    - `updated_at` string, date-time, required — Entity update timestamp
    - `expires_at` string, date-time, required — Date when session expires
    - `session_data` object — Session claims data (ID token claims for users, application claims for applications)
    - `metadata` object, required — Session metadata
      - `name` string, required — Name of the initiating application or user agent
    - `status` 'active' | 'expired' | 'revoked'
    - `active` boolean — Whether the session is currently active (deprecated - use status instead)
    - `session_type` 'application', required
    - `application_id` string, required — Application ID that initiated this session
    - `application` IamApplication — An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
      - `id` string, required — Unique identifier of the application
      - `organization_id` string, required — Organization that owns this application
      - `zone_id` string, required — Zone this application belongs to
      - `slug` string, required — URL-safe identifier, unique within the zone
      - `identifier` string, required — User specified identifier, unique within the zone
      - `name` string, required — Human-readable name
      - `description` string, nullable — Human-readable description
      - `metadata` IamMetadata — Entity metadata
        - `docs_url` string, uri — Documentation URL
        - `icon_url` string, uri — Icon URL
      - `protocols` object, nullable — Protocol-specific configuration
        - `oauth2` IamApplicationOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
          - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application
          - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application
      - `dependencies_count` integer, required — Number of resource dependencies
      - `owner_type` 'platform' | 'customer', required — Who owns this application. Platform-owned applications cannot be modified via API.
      - `consent` 'implicit' | 'required', required — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
      - `created_at` string, date-time, required — Entity creation timestamp
      - `updated_at` string, date-time, required — Entity update timestamp
    - `provider_id` string, required — Provider ID
    - `subject` string, required — Subject claim from IdP
    - `issuer` string, uri, required — Issuer URL from IdP

## Other responses

- `default` — Error response

---

[API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/2f5033ed4491/schema)