Revoke all user sessions
Immediately invalidates all active sessions for a specific user across all devices and browsers, setting their status to 'revoked'. Use this endpoint to implement global logout functionality, force re-authentication after security incidents, or terminate all sessions following a password reset or credential compromise. Only active sessions are revoked; already expired, logout, or previously revoked sessions remain unchanged. The revocation is atomic and instantaneous. Returns a list of all revoked sessions with their details and a total count of sessions revoked.
Path parameters
Unique identifier for the user whose all sessions will be revoked. Must start with 'usr_' prefix.
Response
Successfully revoked all user sessions. Returns the list of revoked sessions and total count
Example response
{
"revoked_sessions": [
{
"absolute_expires_at": "2025-01-22T10:30:00Z",
"created_at": "2025-01-15T10:30:00Z",
"expired_at": "2025-01-15T12:00:00Z",
"idle_expires_at": "2025-01-15T11:30:00Z",
"last_active_at": "2025-01-15T10:55:30Z",
"logout_at": "2025-01-15T14:00:00Z",
"session_id": "ses_1234567890123456",
"status": "revoked",
"updated_at": "2025-01-15T10:45:00Z",
"user_id": "usr_1234567890123456"
}
],
"total_revoked": 5
}