Revoke a subject's default-IdP sessions
Revokes the subject’s default identity provider sessions for this gateway. The call writes a durable revocation into the config-sync snapshot (session_revocations) before it deletes local refresh records. Hybrid, self-hosted, and other customer-run data planes apply that revocation only after they run a TrustGate build that reads session revocations from the config sync (post-#1142). A data plane from before that build ignores the new snapshot field and keeps serving. The control plane can be upgraded first; the revocation takes effect on a plane when that plane is upgraded, if the upgrade comes within 30 days of the revocation (or MCP_DEFAULT_IDP_SESSION_MAX_AGE, if longer). After that, revoke the subject again once the plane runs the new build. An access token already issued keeps working until it expires. revoked is the number of refresh records deleted on the process that handled the call. Zero means this process had none, which is still success. If the durable write fails, the call returns 500 and does not delete those records. A service credential is refused. A user id that is empty or not a plain identifier returns 422.
A valid request URL is required to generate request examples{
"revoked": 123
}{
"error": "<string>",
"message": "<string>"
}{
"error": "<string>",
"message": "<string>"
}{
"error": "<string>",
"message": "<string>"
}{
"error": "<string>",
"message": "<string>"
}{
"error": "<string>",
"message": "<string>"
}Authorizations
Path Parameters
Gateway id
Platform user id (session subject)
Response
OK
Refresh records deleted on the process that handled the call. Zero means this process had none for the subject; that is still success.
A valid request URL is required to generate request examples{
"revoked": 123
}{
"error": "<string>",
"message": "<string>"
}{
"error": "<string>",
"message": "<string>"
}{
"error": "<string>",
"message": "<string>"
}{
"error": "<string>",
"message": "<string>"
}{
"error": "<string>",
"message": "<string>"
}