--- title: "Sign the customer out" method: POST path: "/hd/desks/{desk_id}/auth/logout" tags: ["hd"] --- # Sign the customer out `POST /hd/desks/{desk_id}/auth/logout` ## Request - Base URL: `https://api.sparkvault.com/v1` - URL: `https://api.sparkvault.com/v1/hd/desks/{desk_id}/auth/logout` - Auth: one of: - HTTP bearer - none - TypeScript: (a function with typed inputs; its response is checked against the schema) End the sessions the sign-out's credentials name, on the server. A refresh token in the body is its own proof: the Secure Identity session it names is revoked at the identity service whatever the bearer, stale or absent. A help desk session token (`hdt_…`) as the bearer is revoked; a Secure Identity access token as the bearer, with no refresh token sent, revokes the session it names. A sign-out naming nothing it can end (no credential, or a bearer that is no customer's of this desk) ends nothing and answers the same. On a desk whose customers do not sign in with Secure Identity now, the identity service takes no revocation for it, so a Secure Identity session ends there on its own. ## Path parameters - `desk_id` string, required ## Headers - `X-SV-Client` 'help-desk-portal', required ## Request body - object - `refresh_token` string: The Secure Identity refresh token the portal holds. ## Response `204` Signed out of what the sign-out names, and nothing else: while the desk's customers sign in with Secure Identity, the desk's Secure Identity session the refresh token sent names, or, with none sent, the one a bearer access token of the desk's names; and the help desk session an `hdt_…` bearer is. A bearer access token sent beside a refresh token is not revoked. ## Other responses - `400`: VALIDATION_ERROR — the body is no JSON object, or `refresh_token` is sent and is not a non-empty string of at most 8192 characters. CLIENT_HEADER_REQUIRED — see above. - `429`: RATE_LIMIT_EXCEEDED — this client address has spent its reads at the desk for the minute, or the identity service refused the revocation for its rate. `Retry-After` carries the seconds until the budget reopens, and `details` carries `limit` and `resets_at`. The identity service's own refusal carries only what it names. - `503`: HELP_DESK_UNAVAILABLE — the desk does not take customers right now. INTERNAL_ERROR — the identity service did not answer the revocation, or its keys could not be read to verify the bearer. BUDGET_UNAVAILABLE — a budget the request spends could not be counted, so the request was refused rather than let through uncounted; `Retry-After` carries the seconds to wait before trying again. ## Changes - **2026-10-28** `a9a10e328ba5`: 12 info - the response property `error/details` became required for the status `400` - the response property `error/details` became required for the status `429` - the response property `error/details` became required for the status `503` - the response property `meta` became required for the status `400` - …8 more - **2026-10-28** `56d7c265a77a`: 3 breaking - the response property `error/details` became nullable for the status `400` - the response property `error/details` became nullable for the status `429` - the response property `error/details` became nullable for the status `503` - **2026-10-23** `ad4c62db5e08`: 1 info - endpoint added [Operation history](https://skmtc.dev/sparkvault/apis/sparkvault-api/changes/hd/desks/:desk_id/auth/logout/post.md) --- [API](https://skmtc.dev/sparkvault/apis/sparkvault-api.md) - [All operations](https://skmtc.dev/sparkvault/apis/sparkvault-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sparkvault/apis/sparkvault-api/revisions/97cfadccd0c0?raw)