---
title: "Invalidate a single session"
method: DELETE
path: "/api/v1/maintenance/_sessions/{token}"
tags: ["Maintenance"]
---

# Invalidate a single session

`DELETE /api/v1/maintenance/_sessions/{token}`

Invalidates the session whose HMAC-obfuscated token is supplied. The caller's own session cannot be invalidated this way. The CSRF secret must have been issued by GET /v1/maintenance/_sessions within the last 15 minutes — otherwise this endpoint returns 403 and the client must re-list to refresh.

## Path parameters

- `token` string, required

## Response `200`

Session invalidated

- ResponseEntityStringView
  - `errors` ErrorEntity[]
    - `errorCode` string
    - `message` string
    - `fieldName` string
  - `entity` string
  - `messages` MessageEntity[]
    - `message` string
  - `i18nMessagesMap` object
  - `permissions` string[]
  - `pagination` Pagination
    - `currentPage` integer
    - `perPage` integer
    - `totalEntries` integer

## Other responses

- `400` — Bad request - attempting to invalidate caller's own session
- `401` — Unauthorized - authentication required
- `403` — Forbidden - missing or expired CSRF token, or insufficient role
- `404` — No active session matches the supplied token

---

[API](https://skmtc.dev/jostens/apis/dotcms-rest-api.md) · [All operations](https://skmtc.dev/jostens/apis/dotcms-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jostens/dotcms-rest-api/revisions/a088fe9f515c/schema)