End one CLI session
DELETE/api/auth/cli-sessions/:familyId
End one CLI session. Always revokes the whole refresh family, so the session can no longer refresh. Also revokes the bridge access tokens LINKED to that family, and where at least one was revoked access stops within the ~30s principal-liveness cache window rather than at the end of that token's TTL. Returns what was actually revoked: accessTokensRevoked is legitimately 0 for a family whose backing key rows predate the cli_family_id link — nothing links them, so the token that machine already holds runs to its own expiry. Browser-session only. A non-JSON upstream body is replaced with a DIRECTORY_INVALID_RESPONSE envelope while the UPSTREAM STATUS IS PRESERVED, so a 2xx can carry that error shape instead of data — the 200 schema below models both.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 502
- 503
Successful response
familyId is not a valid UUID. Rejected by the proxy before any upstream call, so a malformed segment never reaches a ::uuid cast.
No authenticated browser session — the request carried no cookies, or the session could not be resolved.
The caller has no active organisation membership; or the x-act-as-org selector named an organisation the caller is not an ACTIVE member of; or the request Origin is missing or not allowlisted — Directory applies a CSRF origin check to this cookie-authenticated state-changing verb, which the GET does not have.
No such session for this caller. Also returned for a same-tenant peer's session, so the endpoint is not an existence oracle.
Directory could not be reached, or its response body could not be read after headers had arrived — both are DIRECTORY_UNREACHABLE.
Directory timed out (DIRECTORY_TIMEOUT), or the deployment is missing its Directory URL configuration — surfaced explicitly rather than falling back to localhost and failing later as a confusing 502.