Revoke a session

DELETE

/sessions/{sessionId}

const url = 'https://auth.timetonic.com/api/sessions/example';
const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request DELETE \
  --url https://auth.timetonic.com/api/sessions/example \
  --header 'Authorization: Bearer <token>'

Revoke one of the authenticated user’s sessions. Invalidates that session’s access token (next request) and its refresh-token chain. Revoking the current session is rejected with 409 — use the logout endpoint instead. A session owned by another user (or unknown) returns 404 with no existence leak.

Authorizations

bearerAuth
sessionCookieAuth

Parameters

Path Parameters

sessionId

required

string

Responses

200

Session revoked

application/json

object

success

boolean

message

string

Example

{
  "success": true
}

401

Authentication required or failed

application/json

object

success

boolean

error

string

message

string

Example

{
  "success": false,
  "error": "unauthorized",
  "message": "Authentication required"
}

404

Session not found (unknown, or owned by another user)

application/json

object

success

boolean

error

string

message

string

Example

{
  "success": false,
  "error": "session_not_found",
  "message": "Session not found."
}

409

Refused — this is the current session (use logout)

application/json

object

success

boolean

error

string

message

string

Example

{
  "success": false,
  "error": "current_session",
  "message": "Use the logout endpoint to end your current session."
}

429

Rate limit exceeded

application/json

object

success

boolean

error

string

message

string

retry_after

integer

Example

{
  "success": false,
  "error": "too_many_requests",
  "message": "Too many requests",
  "retry_after": 45
}