POST
/
api
/
v1
/
auth
/
logout
Logout (current session)
curl --request POST \
  --url https://api.example.com/api/v1/auth/logout
import requests

url = "https://api.example.com/api/v1/auth/logout"

response = requests.post(url)

print(response.text)
const options = {method: 'POST'};

fetch('https://api.example.com/api/v1/auth/logout', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/v1/auth/logout",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/v1/auth/logout"

	req, _ := http.NewRequest("POST", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/auth/logout")
  .asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/auth/logout")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

​
Overview

Revokes the refresh token associated with the caller’s current session, without affecting any other devices the same user may be logged in on. The session id is taken from the sid claim in the access token — clients do not pass anything in the body. After this call, any subsequent /auth/refresh using a refresh token from this session returns 401 UNAUTHENTICATED. The access token itself remains structurally valid until its 15-minute TTL elapses (we do not maintain a JWT blacklist), but on its next refresh the client will be forced to log in again.

​
Authentication

Bearer <accessToken> required. Scope: user.

​
Path parameters

None.

​
Query parameters

None.

​
Request body

None. The session to revoke is identified by the access token’s sid claim.

​
Response — 204 No Content

Empty body. The session is revoked.

​
Error responses

StatusCodeMeaning
401UNAUTHENTICATEDMissing, malformed, or expired access token.

​
Example error — 401

{
  "type": "https://api.swappr.co.uk/errors/unauthenticated",
  "title": "Authentication required",
  "status": 401,
  "code": "UNAUTHENTICATED",
  "detail": "Authenticated user required",
  "instance": "/api/v1/auth/logout",
  "requestId": "01HZQ7K3M4N5P6Q7R8S9T0V1W2"
}

​
Side effects

  • Marks all refresh_tokens rows for the caller’s sessionId with revokedAt = now.
  • Other sessions for the same user are untouched.

​
See also

​
curl

curl -X POST https://api.swappr.co.uk/api/v1/auth/logout \
  -H "Authorization: Bearer $ACCESS_TOKEN"