Log out everywhere

OpenAPI contract

Method

POST

Path

/api/v1/auth/logout-all

Security

jwtBearer (bearer)

Response status

200 400 401 403 429 500

Request and response schemas

JSON

{
  "requestBody": {},
  "responses": {
    "200": {
      "description": "All sessions ended",
      "content": {
        "application/json": {}
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

POST /api/v1/auth/logout-all is JWT-only and has no request body. It revokes all sessions for the authenticated account by advancing its token version, then confirms that all sessions were revoked.

An nfy_ automation key cannot call this endpoint. Treat the current access token as invalid after success and remove all locally stored session tokens. Missing or invalid JWT authentication is rejected.

http

POST /api/v1/auth/logout-all
Authorization: Bearer <access token>