UNunkeyed
portal

Revoke portal sessions

Changed on

Revoke every live session an end user holds on a portal.

Unreleased and subject to change without notice.

Sessions that were created but not yet opened are revoked too, so their portal URLs stop working. Revocation is not instantaneous: session lookups are cached briefly, so a request already in flight may still succeed.

Revoking ends existing sessions only. To keep the end user out, also stop calling portal.createSession for them.

Calling this again for the same end user is safe and revokes nothing.

Required Permissions

Your root key must have one of:

  • portal.*.create_portal_session (for any portal in the workspace)
  • portal.<portal_id>.create_portal_session (for a specific portal)

It also accepts unkey:v1:<workspace_id>:projects/<project_id>/portals/<portal_id>/sessions/*#write, which dashboard roles carry. Unlike portal.createSession, a dashboard session can call this, not just a root key.

A root key that cannot read the portal's sessions gets 404. One that can read them but lacks the permission gets 403.

post/v2/portal.revokeSession

Request

  • Base URL
    https://api.unkey.com
  • URL
    https://api.unkey.com/v2/portal.revokeSession
  • Auth
    HTTP bearer

Request body

portalstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

externalIdstring required

The end user's identifier in your system, as passed to portal.createSession. Every live session this end user holds on the portal is revoked.

Example request

{
  "portal": "proj_1234abcd",
  "externalId": "user_123"
}

Response

The end user's live sessions on the portal are revoked.

Example response

{
  "meta": {
    "requestId": "req_123"
  },
  "data": {
    "sessionsRevoked": 2
  }
}

Changes