Revoke All Sessions

Sign out everywhere (`keep_current: false`, the default; this browser's refresh cookie is cleared) or every other session (`keep_current: true`). Every access token issued so far stops at once (a kept session gets a new one from `/auth/refresh`), and connected apps (OAuth) are signed out too.

API key access

Not available to API keys or connected apps: only a signed-in person can call this route.

POST/api/v1/auth/sessions/revoke-all

Authorization

AuthorizationBearer <token>

Access token from /api/v1/auth/login, or an API key (ro_pat_..., RO-176) from /api/v1/workspaces/current/api-keys: the key implies its workspace and needs the route's scope. MCP connectors (/api/v1/mcp only) may use an OAuth access token (ro_oat_..., RO-284).

In: header

Request Body

keep_current?boolean

Keep this browser's session ("sign out other sessions"); false signs out everywhere.

Defaultfalse

Response Body

curl -X POST "http://localhost:8000/api/v1/auth/sessions/revoke-all" \
  -H "Content-Type: application/json" \
  -d '{}'

curl -X POST "http://localhost:8000/api/v1/auth/sessions/revoke-all" \  -H "Content-Type: application/json" \  -d '{}'

{
  "revoked": 0,
  "current_revoked": true
}

Empty

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}

Authorization

Request Body

Response Body

200

403

422