Terminate all active sessions for an identity

DELETE

/identity-sessions

Marks every currently active session belonging to the given identity as terminated. This is useful for security actions such as "log out everywhere", forcing re-authentication after a password change, or an administrator revoking access for a compromised identity.

The target identity is taken from the identity_id field in the request body, not from the caller's own bearer token, so the authenticated caller and the identity whose sessions are terminated do not have to be the same identity.

The operation is idempotent: sessions that are already terminated are left untouched, and the call still succeeds even if the identity has no active sessions at the time it runs. It does not delete session records, only flips their status to terminated.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

All active sessions for the identity were terminated successfully.

Bodyapplication/json

🟠400

🟠401

Request Example

Shell

JavaScript

Java

Swift

curl --location --request DELETE '/identity-sessions' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "identity_id": "01HQZR2BKPFQ8MXJVT3G7LWNE"
}'

Response Example

200 - Success

{
    "message": "All sessions terminated successfully",
    "status": "success",
    "data": {
        "identity_id": "01HQZR2BKPFQ8MXJVT3G7LWNE",
        "terminated": true
    }
}

Modified at 2026-09-30 00:29:30

Request a login MFA challenge or one-time-passcode

Terminate an identity session