---
title: "Logout"
method: POST
path: "/v1/auth/logout"
tags: ["auth"]
---

# Logout

`POST /v1/auth/logout`

## Request

- Base URL: `https://app.tokumalabs.com/api`
- URL: `https://app.tokumalabs.com/api/v1/auth/logout`
- Auth: none declared

Logout user by revoking the device's refresh-token chain.

Revoking the whole `(user_id, device_id)` family — not just the
presented token — is load-bearing: with rotating refresh tokens,
predecessors of the current tail still sit in the table until the
grace-window sweep prunes them. A bare `revoke_by_token_hash` of
just the tail would leave those predecessors live (the FK's
``ON DELETE SET NULL`` nulls their ``superseded_by_id``), so a
replay during the grace window would walk the now-orphaned
predecessor as if it were the tail and resurrect the session.

## Cookies

- `tokuma_rt` string, nullable

## Request body

- LogoutRequest
  - `refresh_token` string, nullable: Refresh token (optional for non-browser clients)

## Response `204`

Successful Response

## Other responses

- `400`: Validation error or domain rule violation.
- `401`: Missing, expired, or invalid authentication.
- `403`: Authenticated but not permitted.
- `404`: Resource not found.
- `409`: Resource state conflict (duplicate, illegal transition).
- `422`: Request body failed schema validation.
- `500`: Server-side failure.

---

[API](https://skmtc.dev/tokumalabs/apis/tokuma-user-api.md) - [All operations](https://skmtc.dev/tokumalabs/apis/tokuma-user-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tokumalabs/apis/tokuma-user-api/revisions/1f8201af459b?raw)