Log out

OpenAPI contract

Method

POST

Path

/api/v1/auth/logout

Security

jwtBearer (bearer)

Response status

200 400 401 403 429 500

Request and response schemas

JSON

{
  "requestBody": {
    "application/json": {
      "$ref": "#/components/schemas/LogoutRequest"
    }
  },
  "responses": {
    "200": {
      "description": "Session ended",
      "content": {
        "application/json": {}
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

POST /api/v1/auth/logout is JWT-only. Send the current JWT in Authorization: Bearer <access token>; optionally send refreshToken in the JSON body to revoke it as well. The service confirms logout after blacklisting the supplied token values.

An nfy_ automation key cannot call this endpoint. Clear local token storage after the response and never record either token in client diagnostics. Missing or invalid JWT authentication is rejected.

http

POST /api/v1/auth/logout
Authorization: Bearer <access token>