Auth

Revoke a session using a signed email token

Consumes a signed token minted at email-send time by the new-device notification flow. Possession of the token is the auth factor — no existing session cookie is required, no MFA. Returns 200 on any verified-valid token even if the underlying sid is already revoked (idempotent, non-enumerating). Returns 400 on malformed, tampered, expired, or key-mismatched tokens. Public endpoint, rate-limited. See ADR-031.

post/auth/sessions/revoke-via-email

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/auth/sessions/revoke-via-email
  • Auth: none required

Request body

tokenstring required

HS256-signed token from the new-device email link.

Response

Session revocation accepted (idempotent — 200 returned even if the session was already gone).

revoked_atstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.