---
title: "Operator: sign a person out of every browser"
method: DELETE
path: "/api/ops/users/{userId}/sessions"
tags: ["Operator"]
---

# Operator: sign a person out of every browser

`DELETE /api/ops/users/{userId}/sessions`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/api/ops/users/{userId}/sessions`
- Auth: one of:
  - API key in cookie `__Secure-authjs.session-token`
  - API key in cookie `authjs.session-token`

Operator console only: requires the web session of an address in the operator allowlist of this installation, sent from the application itself. Every other signed-in caller and every valid Bearer token receives 404 NOT_FOUND, whether or not this installation has an operator configured; a caller with no valid credential receives 401, as on every route. Recorded in the operator log. Deletes every web session of the person; a connected app keeps working until its grant is revoked. The body gives the reason, from a closed list, and may give a reference: a ticket or card key, never an address. A person who does not exist answers 404.

## Request body

- OpsCredentialRevoke
  - `reasonCode` 'security_incident' | 'customer_request' | 'acceptable_use', required
  - `reference` string

## Response `204`

No content

## Other responses

- `400`: Invalid request
- `401`: Unauthenticated
- `403`: The request did not come from the application’s own origin
- `404`: Not the operator, or no such object
- `409`: Conflict
- `429`: Rate limited
- `500`: Internal server error
- `503`: Temporarily unavailable

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)