Logout
POST
/auth/logout/
const url = 'https://example.com/auth/logout/';const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/auth/logout/ \ --header 'Authorization: Bearer <token>'Revoke all refresh tokens and bump token_version for the current user.
SEC-S15 (Phase 1062-01): revoke_all_tokens bumps User.token_version so the access JWT used for this logout call (and any other outstanding access JWTs) are rejected on the next authenticated request — closing the “logout doesn’t invalidate the access JWT” gap.
Authorizations
Section titled “Authorizations ”Responses
Section titled “ Responses ”Successful Response
Bad request — invalid query parameters or payload
Media type application/problem+json
Unauthorized — missing or invalid credentials
Media type application/problem+json
Forbidden — caller lacks access to this resource
Media type application/problem+json
Not found
Media type application/problem+json
Validation error
Media type application/problem+json
Too many requests — retry after the advertised interval
Media type application/problem+json
Headers
Section titled “Headers ” Retry-After
integer
Seconds until the request may be retried
Internal server error
Media type application/problem+json
Service unavailable — the database could not serve the request
Media type application/problem+json