---
title: "Revoke the current JWT access token (server-side denylist)."
method: POST
path: "/v1/auth/logout"
tags: ["auth"]
---

# Revoke the current JWT access token (server-side denylist).

`POST /v1/auth/logout`

## Request

- Base URL: `https://api.andish.ru` (the document declares no server; this is the origin it was published from)
- URL: `https://api.andish.ru/v1/auth/logout`
- Auth: none declared

Add the current JWT jti to the Redis denylist.

Callers must pass a valid JWT in Authorization: Bearer header.
On success (HTTP 200) the token is invalidated immediately — subsequent
requests using the same token will receive 401 token_revoked.

Fail-closed: if Redis is unavailable the endpoint returns 503 (unlike
is_revoked which is fail-open). A failed revocation is a security regression
so we surface the error rather than silently skip it (per token_denylist.py
docstring).

ADR-019 prefix dispatch: this endpoint is JWT-only. Requests with an API key
Bearer value (adsh_* / mne_*) receive 401 invalid_token — API keys have
their own revocation path (DELETE /v1/api-keys/{id}).

## Response `200`

Token revoked (or already expired — idempotent)

- LogoutResponse: Response for successful POST /v1/auth/logout (HTTP 200). Wire format: {"revoked": true}
  - `revoked` boolean: Always true on success.

## Other responses

- `401`: Missing, expired, or invalid JWT
- `503`: Redis unavailable — revocation could not be persisted

---

[API](https://skmtc.dev/andish/apis/mnemo-api.md) · [All operations](https://skmtc.dev/andish/apis/mnemo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/andish/apis/mnemo-api/revisions/d5449f23414c?raw)