Sign out
Ends the session the presented token belongs to: its refresh token and all of its access tokens stop working immediately. Send the refresh token as `refreshToken` in the body (preferred — it works after the access token has expired), or the access token as `Authorization: Bearer <token>`. When a body refresh token is present, the header is ignored. Idempotent: signing out of a session that has already ended returns 200.
Path Parameters
Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.
uuidRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/logout" \ -H "Content-Type: application/json" \ -d '{}'{ "msg": "Signed out"}Refresh a session
Trades the refresh token for a new access token AND a new refresh token. Refresh tokens are SINGLE-USE: the one you send stops working once exchanged, so always store the pair you get back. Presenting a refresh token that has already been exchanged ends the whole session (`SESSION_ENDED`, reason `reused`) — the server reads it as a stolen token. The one exception is a narrow grace window just after an exchange, so two tabs refreshing at the same moment both receive the same current pair; coordinate refreshes anyway. Pass `activeOrgUid` to switch the session into another organization you are an accepted member of. An `Authorization` header on this request is ignored.
List your sessions
The caller's live sessions: the session making the request first (marked `current: true`), then newest sign-in first. `total` counts every live session, for paging. `label` is a coarse device description ("Chrome on macOS"); the raw user agent is not returned.