curl --request POST \
--url https://app.ohmyho.st/v1/session:revoke \
--header 'Authorization: Bearer <token>' \
--header 'Idempotency-Key: <idempotency-key>'import requests
url = "https://app.ohmyho.st/v1/session:revoke"
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>"
}
response = requests.post(url, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Idempotency-Key': '<idempotency-key>', Authorization: 'Bearer <token>'}
};
fetch('https://app.ohmyho.st/v1/session:revoke', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.ohmyho.st/v1/session:revoke",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.ohmyho.st/v1/session:revoke"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.ohmyho.st/v1/session:revoke")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.ohmyho.st/v1/session:revoke")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"revoked": true
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}Revoke the current signed-in user session
Revokes only the session proven by the bearer credential, confirms its absence from active WorkOS sessions and records local terminal denial. No organization is required. The request body and query must be empty; caller-supplied session or user identifiers are not accepted. Repeated private processing cannot revoke another session. Once revoked, the old bearer is no longer authorized, including for a public replay. This synchronous identity-lifecycle operation does not create a project operation.
curl --request POST \
--url https://app.ohmyho.st/v1/session:revoke \
--header 'Authorization: Bearer <token>' \
--header 'Idempotency-Key: <idempotency-key>'import requests
url = "https://app.ohmyho.st/v1/session:revoke"
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>"
}
response = requests.post(url, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Idempotency-Key': '<idempotency-key>', Authorization: 'Bearer <token>'}
};
fetch('https://app.ohmyho.st/v1/session:revoke', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.ohmyho.st/v1/session:revoke",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.ohmyho.st/v1/session:revoke"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.ohmyho.st/v1/session:revoke")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.ohmyho.st/v1/session:revoke")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"revoked": true
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}{
"type": "<string>",
"title": "<string>",
"status": 499,
"code": "invalid_request",
"request_id": "<string>",
"retryable": true,
"suggested_action": "<string>",
"detail": "<string>",
"instance": "<string>",
"retry_after_seconds": 43200
}Authorizations
WorkOS access JWT or a user-owned WorkOS API key. User keys are bound to one organization and restricted to their enabled product permissions. Session-only onboarding and session revocation require an interactive access JWT. No cookie session is assumed.
Headers
Optional caller-provided correlation identifier.
1 - 128Identifies one mutation and its canonical request payload.
1 - 128Response
Provider session revocation and local terminal denial are confirmed.