README — DELETE /api/admin/admins/{sub}/sessions
DELETE /api/admin/admins/{sub}/sessions
and revokes their refresh tokens (on yourself, the session you're using stays). Audited admin.sessions.revoke.
Caller and authorization
Request contract
| Location | Name | Required | Meaning |
|---|---|---|---|
| path | sub | Yes | Use the ID from an authorized staff response; source validators reject malformed IDs. |
| header | X-Admin-CSRF | Yes | Session-bound token from the staff page; not a developer credential. |
Response and failures
and revokes their refresh tokens (on yourself, the session you're using stays). Audited admin.sessions.revoke.
{error:{code,message}} for CloudError failures, attaches Request-Id, and disables caching. Handle 401 by signing in; show role refusal for 403 forbidden, reauthenticate only for step_up_required, and collect a reason for 400 reason_required. A CSRF failure needs a current page/session token, not blind retries. Operation-specific 404/409/413/422/502/503 errors retain their status. Honor Retry-After on 429.Implementation contract
/**
* DELETE /api/admin/admins/:sub/sessions (admins.sessions, step-up): signs that admin out of every console session
* and revokes their refresh tokens (on yourself, the session you're using stays). Audited admin.sessions.revoke.
*/
export const DELETE = adminRoute("admins.sessions", async (_request, ctx, { params }: Context) => {
const { sub } = await params;
if (!/^[\w.-]{1,128}$/.test(sub)) throw new CloudError(404, "not_found", "Admin not found.");
return adminJson(await revokeSessions(ctx, sub));
});Modified at 2026-10-26 13:41:16