Revoke one of an identity's sessions (admin)
/api/v1/identities/{id}/sessions/{sessionId}Revokes one of an identity's sessions in the caller's Environment (server-to-server admin) by marking its refresh token revoked, so the next refresh from that device returns 401 while every other session carries on. Audited as identity.session.revoked, the same row the person's own per-session sign-out writes. Returns 204 No Content; returns 404 when the identity has no membership in this Environment, or when the session is not the identity's, belongs to another Environment, or is already revoked.
Authentication
Authorization Option A JWT access token. Never send alongside X-API-Key: a request carrying both is refused.
X-API-Key Option B API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.
Path Parameters
idstring Required sessionIdstring Required Responses
The session's refresh token is revoked, so its next refresh returns 401 while the identity's other sessions carry on. In-flight access tokens keep working until their short TTL expires.
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
curl -X DELETE "https://auth.canopy-io.com/api/v1/identities/value/sessions/value" \ -H "X-API-Key: $CANOPY_API_KEY"
HTTP/1.1 204 The session's refresh token is revoked, so its next refresh returns 401 while the identity's other sessions carry on. In-flight access tokens keep working until their short TTL expires. (empty body)
Tell us how we can improve this guide.