---
title: "Api Whip Publish Delete"
method: DELETE
path: "/api/whip/publish/{session_id}"
---

# Api Whip Publish Delete

`DELETE /api/whip/publish/{session_id}`

## Request

- Base URL: `https://sleipnir.tv` (the document declares no server; this is the origin it was published from)
- URL: `https://sleipnir.tv/api/whip/publish/{session_id}`
- Auth: none declared

Ends a WHIP session (WHIP has no renegotiation -- reconnect means a
fresh POST /api/whip/publish). Cross-user replay is structurally
blocked: the internal DELETE URL is rebuilt from the CALLER's own
stream key, so a guessed session_id under another user's key just
404s at `whip` rather than tearing down someone else's stream.

That scoping holds only while session_id stays inside its own path
segment. FastAPI's `{session_id}` will not match a literal '/', but it
DOES accept a percent-encoded one and hand it back decoded, so
`..%2F..%2Fotherkey%2Fwhip%2F<id>` would interpolate straight past the
caller's own stream key and tear down another user's session. Hence the
shape check rather than trusting the route pattern.

## Path parameters

- `session_id` string, required

## Cookies

- `relay_session` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sleipnir/apis/relay-control-plane.md) · [All operations](https://skmtc.dev/sleipnir/apis/relay-control-plane/llms.txt) · [OpenAPI document](https://skmtc.dev/sleipnir/apis/relay-control-plane/revisions/79829f6945a4?raw)