Signs a user out of every session.

POST /api/identity/sessions/revoke-all deprecated

Requires: AbpIdentity.Sessions, AbpIdentity.Sessions.RevokeAll, host scope.

Records the justification on the user's security log. Requires the revoke-all sessions permission, and the platform administrator role to name anyone but the caller. When the user is the caller, the session the call is made from is kept.

Try this in the console

Example request

Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.

The request body is a RevokeAllUserSessionsInput. See the Request body section below for its fields.

cURL PowerShell TypeScript C# Python

cURL

curl -X POST "{{BASE_URL}}/api/identity/sessions/revoke-all" \
  -H "api-key: {{API_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "justification": ""
}'

PowerShell

$headers = @{
    'api-key' = '{{API_KEY}}'
}

$body = @'
{
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "justification": ""
}
'@

$response = Invoke-RestMethod -Method POST -Uri '{{BASE_URL}}/api/identity/sessions/revoke-all' `
    -Headers $headers -ContentType 'application/json' -Body $body

npm install @winkpg/winkpg-api

TypeScript (SDK)

import { Configuration, UsersApi } from '@winkpg/winkpg-api';

const api = new UsersApi(new Configuration({
  basePath: '{{BASE_URL}}',
  apiKey: '{{API_KEY}}',
}));

const { data } = await api.sessionsRevokeAllForUser({
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "justification": ""
});

TypeScript (raw HTTP)

const response = await fetch('{{BASE_URL}}/api/identity/sessions/revoke-all', {
  method: 'POST',
  headers: {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "justification": ""
  }),
});

const data = await response.json();

dotnet add package WinkPg.Api.Client

C# (SDK)

using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;
using System.Text.Json;

var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");

var api = new UsersApi(config);
var body = JsonSerializer.Deserialize<RevokeAllUserSessionsInput>("""
    {
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "justification": ""
    }
    """);

var result = await api.SessionsRevokeAllForUserAsync(body);

C# (raw HTTP)

using System.Text;

using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };

var request = new HttpRequestMessage(new HttpMethod("POST"), "/api/identity/sessions/revoke-all");
request.Headers.Add("api-key", "{{API_KEY}}");

request.Content = new StringContent("""
    {
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "justification": ""
    }
    """, Encoding.UTF8, "application/json");

var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();

pip install winkpg-api

Python (SDK)

import winkpg_api

configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"

with winkpg_api.ApiClient(configuration) as client:
    api = winkpg_api.UsersApi(client)
    body = winkpg_api.RevokeAllUserSessionsInput.from_dict({
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "justification": ""
    })
    result = api.sessions_revoke_all_for_user(body)

pip install requests

Python (raw HTTP)

import requests

headers = {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
}

body = {
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "justification": ""
}

response = requests.request(
    "POST",
    "{{BASE_URL}}/api/identity/sessions/revoke-all",
    headers=headers,
    json=body,
)
response.raise_for_status()
data = response.json()

Parameters

Name	In	Type	Description
`suppressNulls` required	query	boolean	If true, omit properties with null values.

Request body

application/json , required

Field	Type	Description
`userId` required	string (uuid)	The user whose sessions are revoked.
`justification` required	string	Why the sessions are being revoked. Required, at most 500 characters, and written to the affected user's security log alongside the administrator who gave it. nullablemax length 500

This request body has no documented fields.