Zitadel Preview Docs

Revoke session

Permanently deletes the session, terminating it immediately. This is the operator revoke path and requires the `session.delete` scope on a project-bound credential. End-user logout with the `__nextgen_session` cookie is `DELETE /sessions/me` (`nextgenSession` scheme). Idempotent: deleting a session that does not exist (or was already deleted) still returns 204. After deletion, any tokens derived from the session are invalidated.

DELETE
/sessions/{session_id}

Permanently deletes the session, terminating it immediately.

This is the operator revoke path and requires the session.delete scope on a project-bound credential. End-user logout with the __nextgen_session cookie is DELETE /sessions/me (nextgenSession scheme).

Idempotent: deleting a session that does not exist (or was already deleted) still returns 204. After deletion, any tokens derived from the session are invalidated.

Authorization

oauth2 session.delete
AuthorizationBearer <token>

In: header

Scope: session.delete

Path Parameters

session_id*string

The unique identifier of the session.

Response Body

application/json

application/json

application/json

curl -X DELETE "https://example.com/sessions/sess_01J0Z9KX7Y0Q2Y7JX5M9K2YF3C"
Empty
{  "code": "string",  "message": "string",  "details": {}}
{  "code": "string",  "message": "string",  "details": {}}

{  "code": "auth.unauthorized",  "message": "The request lacks valid authentication credentials."}