---
title: "Revoke all user sessions"
method: POST
path: "/api/v1/users/{user_id}/sessions/revoke"
tags: ["Sessions"]
---

# Revoke all user sessions

`POST /api/v1/users/{user_id}/sessions/revoke`

Immediately invalidates all active sessions for a specific user across all devices and browsers, setting their status to 'revoked'. Use this endpoint to implement global logout functionality, force re-authentication after security incidents, or terminate all sessions following a password reset or credential compromise. Only active sessions are revoked; already expired, logout, or previously revoked sessions remain unchanged. The revocation is atomic and instantaneous. Returns a list of all revoked sessions with their details and a total count of sessions revoked.

## Path parameters

- `user_id` string, required

## Response `200`

Successfully revoked all user sessions. Returns the list of revoked sessions and total count

- SessionsRevokeAllUserSessionsResponse
  - `revoked_sessions` SessionsRevokedSessionDetails[] — List of all sessions that were revoked, including detailed information for each revoked session with IDs, timestamps, and device details.
    - `absolute_expires_at` string, date-time — The absolute expiration timestamp that was configured for this session before revocation. Represents the hard deadline regardless of activity.
    - `created_at` string, date-time — Timestamp indicating when the session was originally created before revocation.
    - `expired_at` string, date-time — Timestamp when the session was actually terminated. Set to the revocation time when the session is revoked.
    - `idle_expires_at` string, date-time — The idle expiration timestamp that was configured for this session before revocation. Represents when the session would have expired due to inactivity.
    - `last_active_at` string, date-time — Timestamp of the last recorded user activity in this session before revocation. Helps identify inactive sessions that were revoked.
    - `logout_at` string, date-time — Timestamp when the user explicitly logged out (if applicable). Null if the session was revoked without prior logout.
    - `session_id` string — Unique identifier for the revoked session. System-generated read-only field.
    - `status` string — Status of the session after revocation. Always 'revoked' since only active sessions can be revoked. Sessions that were already expired or logged out are not included in the revocation response.
    - `updated_at` string, date-time — Timestamp indicating when the session was last modified before revocation.
    - `user_id` string — Unique identifier for the user who owned this session.
  - `total_revoked` integer — Total count of active sessions that were revoked. Useful for confirmation and audit logging.

---

[API](https://skmtc.net/scalekit/apis/scalekit-api-reference.md) · [All operations](https://skmtc.net/scalekit/apis/scalekit-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scalekit/scalekit-api-reference/versions/a40d5d4650e5/schema)