Ends the sessions a provider says are over.

Why this answers in the OAuth error shape

Every other endpoint answers {"code": ..., "message": ...}. This one answers {"error": ..., "error_description": ...} because the caller is an identity provider following OpenID Connect Back-Channel Logout 1.0, whose section 2.8 defines the refusal format. A provider that cannot parse the refusal keeps retrying a token that will never work.

Why it is unauthenticated

The caller is a server with no account here. The token's signature, checked against keys from the configured issuer, stands in for a credential. See auth::oidc::logout.

Errors

404 when accounts are switched off. An untrustworthy token is a 400 with the reason, never a 500.