opschain admin sessions revoke
Included from Basic tier
opschain admin sessions revoke <session-id>
Revokes one session by id (opschain admin sessions list names it) over the
v2 AuthService (RevokeSession). Your own sessions revoke under your own
authority; another user's needs the /admin updatable determination
(admin revoke-any) — a denied caller reads
not-found. The revocation is immediate: the session's refresh token dies
server-side and its short-lived access token lapses within its validity
window (15 minutes at most). The user's other sessions stay live — to end
them all, disable the user (opschain admin users disable), which cascades
to session revocation.
Every revocation lands on the audit trail (api:auth:* vocabulary), with
the admin lane recorded as admin_revoked.
A server target is required (--server <url>, OPSCHAIN_SERVER or the
active context) and you must be logged in (opschain login). The command
takes no flags of its own; prints revoked session <id> unless --quiet.
Exit codes
| Code | Meaning |
|---|---|
| 0 | The session was revoked. |
| 1 | The server refused or failed the request (an unknown or denied session id reads not-found). |
| 2 | Usage error (missing id, no server target, or not logged in). |
Examples
opschain admin sessions list goran
opschain admin sessions revoke 01999a7e-2b61-7c3e-9f00-3c1f6a1be001
See also
opschain docs cli/admin-sessions-list— finding the session id.opschain docs cli/admin-users— disabling a user revokes every session.opschain docs identity— the session lane end to end.