End session by user sub

POST 
/session/end_session/:sub

Service/admin API to terminate all active sessions for a user identified by sub.

When to use:

• Programmatic session cleanup (e.g. admin tools, user-status flows)
• Not for browser logout — for RP-initiated logout, use the end_session API instead

How it works:

1. Requires a valid access token with cidaas:session_delete scope (typically client credentials)
2. All sessions and access tokens matching the given sub are invalidated
3. Returns a JSON response with data.deleted: true on success (no redirect)
4. When sessions are actually modified, a logout activity fact is stored asynchronously

Differences from public end_session:

• No id_token_hint, access_token_hint, or session cookie required
• No redirect or post_logout_redirect_uri

Request

Responses

200

Session end request processed successfully.

400

Bad Request. Known error codes:

Code	When
AATON1019	Invalid sub in path (returns flat JSON with error, error_description, code)

401

Unauthorized — access token missing, invalid, or insufficient scope