---
title: "Invalidate Tokens"
method: POST
path: "/organization/invalidateTokens"
tags: ["organization"]
---

# Invalidate Tokens

`POST /organization/invalidateTokens`

## Request

- Base URL: `https://api.mercoa.com`
- URL: `https://api.mercoa.com/organization/invalidateTokens`
- Auth: HTTP bearer

Invalidate all JWT tokens for the current organization. This is considered a break-glass action and should be used only if tokens have been compromised. All tokens will be invalidated, including tokens on links, emails, and currently logged in sessions. API keys are not affected by this action. This action may take 60 seconds to propagate.

## Request body

- object
  - `sessionId` string[]: Optional list of session IDs to invalidate. If not provided, all sessions will be invalidated.

## Response `200`

Successful response

## Other responses

- `400`: Error response with status 400
- `401`: Error response with status 401
- `403`: Error response with status 403
- `404`: Error response with status 404
- `409`: Error response with status 409
- `500`: Error response with status 500
- `501`: Error response with status 501

---

[API](https://skmtc.dev/mercoa/apis/mercoa-2.md) - [All operations](https://skmtc.dev/mercoa/apis/mercoa-2/llms.txt) - [OpenAPI document](https://skmtc.dev/mercoa/apis/mercoa-2/revisions/00a8e403ae18?raw)