End the session
POST
/auth/logout
const url = 'https://example.com/auth/logout';const options = {method: 'POST'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/auth/logoutClears the server-side session, which is what actually revokes the cookie
— SessionAuthMiddleware fails closed without an identity, so a stale
cookie left in the browser grants nothing.
CSRF-guarded. No session required: logging out an already-logged-out caller is a no-op.
Responses
Section titled “Responses”Logged out
Media typeapplication/json
object
data
required
object
logged_out
required
boolean
error
string
Example generated
{ "data": { "logged_out": true }, "error": "example"}Cross-origin call
Media typeapplication/json
object
data
Data is always null on an error response.
error
required
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
string
error_code
required
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
string
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}