Revoke one of my sessions

DELETE

/account/sessions/{id}

• Local development behind nginx (port 8088 by default)

Ownership-checked: revokes only when the session id belongs to the caller. 404 covers both “wrong owner” and “no such session” so existence can’t be probed.

In demo mode (AA_DEMO_MODE=1) every visitor shares one account, so the caller’s “other” sessions belong to other people. Only the session authenticating the request may be revoked; anything else is 403 (#567).

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

id

required

string format: uuid

Responses

204

Session revoked.

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed