> ## Documentation Index > Fetch the complete documentation index at: https://docs.endstate.io/llms.txt > Use this file to discover all available pages before exploring further. # Revoke the bearer session token > Immediately invalidates the session token presented in the `Authorization: Bearer end_sess_*` header. Subsequent requests with the token are rejected as expired. Revoke when a client flow finishes early rather than waiting for the token's expiry. ## OpenAPI ````yaml /openapi.json delete /v1/session-tokens/current openapi: 3.1.0 info: title: Endstate API version: 0.1.0 description: Endstate developer API for chip verification and ownership workflows. servers: - url: https://api2.endstate.io description: Production - url: https://api-staging.endstate.io description: Staging security: [] paths: /v1/session-tokens/current: delete: tags: - Session Tokens summary: Revoke the bearer session token description: >- Immediately invalidates the session token presented in the `Authorization: Bearer end_sess_*` header. Subsequent requests with the token are rejected as expired. Revoke when a client flow finishes early rather than waiting for the token's expiry. operationId: revokeCurrentSessionToken responses: '204': description: The session token has been revoked. '401': description: >- Authentication failed. | Error code | When | | --- | --- | | `auth.unauthorized` | Credential is missing or malformed. | | `session_token.invalid_or_expired` | The session token is unknown, expired, or has been revoked. | x-error-codes: - auth.unauthorized - session_token.invalid_or_expired content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: auth.unauthorized: summary: Credential is missing or malformed. value: error: code: auth.unauthorized message: Credential is missing or malformed. request_id: req_8e1a7f50-90ab-4cde-f012-3456789abcde doc_url: https://docs.endstate.io/errors/auth-unauthorized session_token.invalid_or_expired: summary: The session token is unknown, expired, or has been revoked. value: error: code: session_token.invalid_or_expired message: >- The session token is unknown, expired, or has been revoked. request_id: req_8e1a7f50-90ab-4cde-f012-3456789abcde doc_url: >- https://docs.endstate.io/errors/session-token-invalid-or-expired '403': description: >- Authenticated, but not permitted. | Error code | When | | --- | --- | | `auth.forbidden` | Credential is valid but does not have access to the requested resource or action. | x-error-codes: - auth.forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: auth.forbidden: summary: >- Credential is valid but does not have access to the requested resource or action. value: error: code: auth.forbidden message: >- Credential is valid but does not have access to the requested resource or action. request_id: req_8e1a7f50-90ab-4cde-f012-3456789abcde doc_url: https://docs.endstate.io/errors/auth-forbidden '429': description: |- Too many requests. | Error code | When | | --- | --- | | `rate_limit.exceeded` | Per-key rate limit exceeded. | x-error-codes: - rate_limit.exceeded content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: rate_limit.exceeded: summary: Per-key rate limit exceeded. value: error: code: rate_limit.exceeded message: Per-key rate limit exceeded. request_id: req_8e1a7f50-90ab-4cde-f012-3456789abcde doc_url: https://docs.endstate.io/errors/rate-limit-exceeded '500': description: >- Something went wrong on our end. | Error code | When | | --- | --- | | `internal.error` | An unexpected server error occurred. Retry with exponential backoff and include `request_id` in any support request. | x-error-codes: - internal.error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal.error: summary: >- An unexpected server error occurred. Retry with exponential backoff and include `request_id` in any support request. value: error: code: internal.error message: >- An unexpected server error occurred. Retry with exponential backoff and include `request_id` in any support request. request_id: req_8e1a7f50-90ab-4cde-f012-3456789abcde doc_url: https://docs.endstate.io/errors/internal-error security: - SessionTokenBearer: [] components: schemas: ErrorResponse: type: object properties: error: type: object properties: code: anyOf: - $ref: '#/components/schemas/ErrorCode' - type: string description: >- Stable, namespaced error code. The `ErrorCode` catalogue lists every code defined today; handle an unrecognized value as a generic failure rather than throwing, since codes are added over time. example: chip.not_found message: type: string description: >- Human-readable description, for logs and debugging. Wording may change without notice - never parse or match against it. example: Chip not found request_id: type: string description: >- Identifier for this request, matching the `X-Request-Id` response header. Log it and include it in any support request. example: req_8e1a7f50-90ab-4cde-f012-3456789abcde doc_url: type: string description: Documentation page for this error code. example: https://docs.endstate.io/errors/chip-not-found details: $ref: '#/components/schemas/ValidationErrorDetails' required: - code - message - request_id - doc_url required: - error description: >- Every error response, regardless of endpoint or HTTP status, uses this envelope. ErrorCode: type: string enum: - validation.failed - auth.unauthorized - auth.forbidden - session_token.invalid_or_expired - session_token.wrong_chip - not_found.resource - rate_limit.exceeded - chip.not_found - chip.invalid_e_value - chip.already_scanned - quota.exceeded - chip.not_a_test_chip - unit.not_found - unit.already_exists - unit.not_minted - collection.not_found - collection.already_exists - collection.not_active - chip.already_paired - chip.bulk_mixed_collections - chip.bulk_pending - unit.issuance_pending - claim.owner_unknown - claim.already_to_recipient - claim.in_progress - claim.not_found - chip_replacement.locked - chip_replacement.in_progress - chip_replacement.not_found - transfer.owner_unknown - transfer.already_to_recipient - transfer.in_progress - transfer.not_found - idempotency.key_conflict - idempotency.in_progress - internal.error description: >- Stable, namespaced error code in `.` form. Branch on this rather than on `message` or the HTTP status. This is the catalogue as of this spec revision, not a closed set - see `ErrorResponse.error.code`. example: chip.not_found ValidationErrorDetails: type: object properties: formErrors: type: array items: type: string description: Issues that apply to the request as a whole rather than one field. example: [] fieldErrors: type: object additionalProperties: type: array items: type: string description: Validation issues keyed by the field that failed. example: name: - Required required: - formErrors - fieldErrors description: Per-field validation detail. Present only on `validation.failed`. securitySchemes: SessionTokenBearer: type: http scheme: bearer bearerFormat: end_sess description: >- Use `Authorization: Bearer end_sess_*` for V2 browser session tokens (e.g. `end_sess_ZW5kc3RhdGUtZXhhbXBsZS1zZXNzaW9uLXRva2VuAAA`). ````