Revoke a specific authentication session.

Authentication: JWT token required Access: Users can only revoke their own sessions Purpose: Selective session termination for security

Path Parameters:

• session_id: Session identifier to revoke

Request: No request body required

Success Response Schema:

{
  "message": "Session revoked successfully"
}

Revocation Process:

• Validates session belongs to current user
• Invalidates the specified session token
• Removes session from active sessions list
• Logs revocation event for security audit

Use Cases:

• Log out from specific device while staying logged in on others
• Security response to suspicious session activity
• Remote device management (e.g., lost phone)
• Granular session control

Security Features:

• Users can only revoke their own sessions (privacy protection)
• Immediate token invalidation
• Audit logging for security monitoring
• No impact on other active sessions

Session Identification:

• Use GET /user/me/sessions to list sessions and get session IDs
• Sessions are identified by unique session identifiers
• Current session can be revoked (will require re-authentication)

Error Responses:

• 401 Unauthorized: JWT token required
• 404 Not Found: Session not found or doesn't belong to user
• 500 Internal Server Error: Failed to revoke session