POST
/
api
/
v1
/
admin
/
auth
/
logout
Admin logout
curl --request POST \
  --url https://api.example.com/api/v1/admin/auth/logout
import requests

url = "https://api.example.com/api/v1/admin/auth/logout"

response = requests.post(url)

print(response.text)
const options = {method: 'POST'};

fetch('https://api.example.com/api/v1/admin/auth/logout', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/admin/auth/logout",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/admin/auth/logout"

req, _ := http.NewRequest("POST", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/admin/auth/logout")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/admin/auth/logout")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

Overview

Revokes the supplied admin refresh token so it can no longer be rotated. The access token is short-lived (15 min) and is not tracked server-side, so logout only needs to invalidate the refresh side — the access token simply expires. The operation is idempotent: a malformed, unknown, or already-revoked token is treated as a successful no-op and still returns 204. This means a client can fire-and-forget logout without handling “token already gone” as an error.

Authentication

None required. The refreshToken in the body is the credential being revoked.

Path parameters

None.

Query parameters

None.

Request body

FieldTypeRequiredNotesExample
refreshTokenstringyes1..2048 chars. The refresh token to revoke.rt_a1b2c3…

Example payload

{
  "refreshToken": "rt_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
}

Response — 204 No Content

Empty body. Returned both when a live token was revoked and when the token was already gone (idempotent no-op).

Error responses

StatusCodeMeaning
400VALIDATION_FAILEDrefreshToken field missing or out of length bounds.
There is deliberately no 401/404 here. An unknown or already-revoked token returns 204, not an error — the desired end-state (token cannot be used) is already true.

See also

  • Admin refresh — rotate instead of revoke.
  • Ban user — server-side bulk revocation of a user’s refresh tokens.

curl

curl -X POST https://api.swappr.co.uk/api/v1/admin/auth/logout \
  -H "Content-Type: application/json" \
  -d '{ "refreshToken": "'"$ADMIN_REFRESH_TOKEN"'" }'

Postman

See docs/postman/swappr.postman_collection.jsonAdmin Auth → Logout.