API Reference
Revoke Other Sessions
Revoke every active session belonging to the calling user except the one tied to the bearer token used for this request. Powers "sign out everywhere else" flows in the dashboard. Idempotent — already-revoked sessions are skipped.
DELETE/sessions
Authentication
Accepts a JWT bearer token (Authorization: Bearer eyJ…) or an API key (X-API-Key: ms_live_…). API-key callers should send X-Project-ID unless the key is project-locked. Cross-tenant operators must send X-Tenant-ID.
Response
Returns 200 OK with the following body.
| Field | Type | Required | Description |
|---|---|---|---|
revoked | integer | optional | Number of sessions transitioned to revoked. |
kept_session_id | integer | optional | The session id preserved (extracted from the bearer token sid claim). null when the call is not bearer-authenticated. |
200.json
{"revoked": 3,"kept_session_id": 99}
Errors
| Status | Code | Description |
|---|---|---|
| 400 | validation_error | Body or query failed schema validation. The error includes the offending field name. |
| 401 | unauthenticated | Missing or invalid bearer token / API key. |
| 403 | forbidden | Authenticated principal lacks the required scope, role, or project access. |
| 404 | not_found | Target resource does not exist or is not visible to the calling tenant. |
| 429 | rate_limited | Per-IP or per-route limit exceeded. Respect the Retry-After header. |
| 500 | internal_error | Unhandled server error. Quote the request_id when contacting support. |
Examples
cURL
curl -X DELETE https://api.memorysync.io/sessions \-H "Authorization: Bearer $MEMORYSYNC_KEY"
javascript
import { MemorySync } from 'memorysync'const client = new MemorySync({ apiKey: process.env.MEMORYSYNC_KEY })const result = await client.request({method: 'DELETE',path: '/sessions',})console.log(result)
python
from memorysync import Clientclient = Client(api_key=os.environ["MEMORYSYNC_KEY"])result = client.request(method="DELETE",path="/sessions",)print(result)
Behavior & notes
Requires an authenticated org-member role (owner, admin, developer, or auditor) with IP enforcement and MFA. Concurrent logouts that race this call are tolerated — failures on individual sessions are silently skipped. Companion routes: GET /sessions, DELETE /sessions/{session_id}.