Revoke all tokens issued before now — server token only

POST

/v1/users/{id}/revoke-tokens

const url = 'http://localhost:3000/v1/users/example/revoke-tokens';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:3000/v1/users/example/revoke-tokens \
  --header 'Authorization: Bearer <token>'

Writes users.revoked_before = now() + 1s and publishes {tenant}:revoked-before:{userId} to Redis in the same operation. The +1s is not slack: iat has one-second resolution, so a token minted in the same second as the revoke would otherwise survive it (spec §5).

Authorizations

bearerAuth

Parameters

Path Parameters

required

string

Responses

204

Revoked

403

Authenticated but not permitted.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}