Revoke all sessions for an end user.

DELETE

/api/admin/users/{id}/sessions

Code sample: Shell / cURL

curl --request DELETE \
  --url https://auth.example.com/api/admin/users/example/sessions \
  --header 'Authorization: Bearer <token>'

Revoke all persisted and sharded sessions for a user and update the per-user session revocation epoch. Suspended and locked accounts remain addressable. This operation does not require reading the user’s personal profile. Downstream logout and audit retain the sessions ended by the revocation epoch update.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Path Parameters

id

required

string

Header Parameters

X-Tenant-Id

string

Tenant selector for multi-tenant admin requests.

Responses

200

Revoke all user sessions response.

Media type application/json

object

success

required

boolean

message

required

string

userId

required

string

revokedCount

required

integer

storeRevokedCount

required

integer

revokedAfterMs

required

Unix timestamp in milliseconds.

integer format: int64

key

additional properties

Example

{
  "success": true,
  "message": "All located user sessions were revoked.",
  "userId": "user_123",
  "revokedCount": 3,
  "storeRevokedCount": 2,
  "revokedAfterMs": 1770000000000
}

404

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}