Logout Current Session
Revoke only the presented session's refresh-token family.
Other devices and API keys survive. Access JWTs remain usable until their normal expiry; /logout/ still immediately revokes every access and refresh session. A valid signed access JWT with sid, a refresh body token, or a refresh cookie authorizes this operation. Legacy JWTs without sid must use the refresh credential. Cookie authorization requires double-submit CSRF.
Bearer/body revocation does not change cookies, allowing a captured old session to be discarded safely after a newer login. Cookie authorization clears the browser's refresh and CSRF cookies.
Request
- The document declares no server URL.
- Auth: none declared
Headers
Double-submit CSRF token, enforced only when the refresh cookie is what authenticates the call. Echo the value of the geolens_csrf cookie issued alongside the refresh cookie. Callers presenting a refresh token in the request body do not send it.
Request body
Response
Successful Response
Changes
No recorded changes to this operation across all 50 revisions of this API.