---
title: "Revoke Company Sessions"
method: POST
path: "/internal/company/revoke-sessions"
tags: ["internal"]
---

# Revoke Company Sessions

`POST /internal/company/revoke-sessions`

## Request

- Base URL: `https://api.kobaltlabs.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.kobaltlabs.com/internal/company/revoke-sessions`
- Auth: none declared

Revoke every active SuperTokens session for a company's users.

Used at the WorkOS cutover: WorkOS sessions live client-side and are
unaffected, but a SuperTokens session survives a `login_provider_type`
flip for up to the refresh-token lifetime (~6 days idle). Revoking forces
the company's users back through /auth, where the email-first router sends
them to their newly-assigned provider. Reversible — users simply sign in
again.

## Request body `application/x-www-form-urlencoded`

- BodyRevokeCompanySessionsInternalCompanyRevokeSessionsPost
  - `company_id` string, uuid, required

## Response `200`

Successful Response

- RevokeSessionsResponse
  - `users_targeted` integer, required
  - `sessions_revoked` integer, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kobaltlabs/apis/kobaltlabs-api.md) - [All operations](https://skmtc.dev/kobaltlabs/apis/kobaltlabs-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kobaltlabs/apis/kobaltlabs-api/revisions/8587332d5e43?raw)