Ends one of the caller's sessions.

DELETE

/api/v1/sessions/{id}

Why an identifier that is not yours is a `404`

The same answer as one that never existed, and as one that is not an identifier at all. Telling them apart would make this endpoint a way to ask which identifiers exist and who they belong to.

Why a session that had already finished is a `204`

The caller asked for it to stop working, and it does not work. Answering 404 for a row they can see in their own list would be a puzzle, and would mean a list that went stale between loading and clicking reports a problem where there is none. Nothing is written, so the time it ended does not move.

Errors

401 when nothing was signed in, 403 when a bearer token was used, 404 when no session of the caller's has that identifier.

Authorization

session

cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

Path Parameters

id*string

Which session to end

Response Body

It no longer works

curl -X DELETE 'https://example.com/api/v1/sessions/string'

Empty