ZitadelDocs

Revoke session

Permanently deletes the session, terminating it immediately. This is the operator revoke path and requires the `session.delete` scope on a project-bound credential. End-user logout with the `__nextgen_session` cookie is `DELETE /sessions/me` (`nextgenSession` scheme). Idempotent: deleting a session that does not exist (or was already deleted) still returns 204. After deletion, any tokens derived from the session are invalidated.

DELETE
/sessions/{session_id}

Permanently deletes the session, terminating it immediately.

This is the operator revoke path and requires the session.delete scope on a project-bound credential. End-user logout with the __nextgen_session cookie is DELETE /sessions/me (nextgenSession scheme).

Idempotent: deleting a session that does not exist (or was already deleted) still returns 204. After deletion, any tokens derived from the session are invalidated.

Authorization

oauth2 session.delete
headerAuthorizationBearer <token>

Scope: session.delete

Path Parameters

session_id*string

The unique identifier of the session.

Match^sess_[a-zA-Z0-9_-]+$

Response Body

Session deleted. Idempotent — also returned when the session was already absent.

curl -X DELETE 'https://example.com/sessions/string'
Empty