Admin logout
Auth
Admin logout
Revoke an admin refresh token. Idempotent — an unknown or already-revoked token still returns 204.
POST
Admin logout
Overview
Revokes the supplied admin refresh token so it can no longer be rotated. The access token is short-lived (15 min) and is not tracked server-side, so logout only needs to invalidate the refresh side — the access token simply expires. The operation is idempotent: a malformed, unknown, or already-revoked token is treated as a successful no-op and still returns204. This means a client can fire-and-forget logout without handling “token already gone” as an error.
Authentication
None required. TherefreshToken in the body is the credential being revoked.
Path parameters
None.Query parameters
None.Request body
| Field | Type | Required | Notes | Example |
|---|---|---|---|---|
refreshToken | string | yes | 1..2048 chars. The refresh token to revoke. | rt_a1b2c3… |
Example payload
Response — 204 No Content
Empty body. Returned both when a live token was revoked and when the token was already gone (idempotent no-op).
Error responses
| Status | Code | Meaning |
|---|---|---|
| 400 | VALIDATION_FAILED | refreshToken field missing or out of length bounds. |
There is deliberately no 401/404 here. An unknown or already-revoked token returns
204, not an error — the desired end-state (token cannot be used) is already true.See also
- Admin refresh — rotate instead of revoke.
- Ban user — server-side bulk revocation of a user’s refresh tokens.
curl
Postman
Seedocs/postman/swappr.postman_collection.json → Admin Auth → Logout.