Revoke sessions

Revoke sessions when you suspect a compromised account, when a user leaves the organization, or when you need permission changes to take effect immediately.

Session revocation requires the admin role with admin:revocation:execute permission.

Revocation methods

The session store supports multiple revocation methods.

Table 1. Session revocation methods
Method Scope
Revoke by session A user logs out
Revoke by user Terminates all sessions for a specific user
Revoke by identity provider Terminates all sessions authenticated through a specific provider
Revoke by identity A user's identity provider identity is disconnected
Global token revocation Invalidates all tokens system-wide by setting a global revocation timestamp. All tokens issued before this timestamp are treated as invalid.

When sessions are revoked:

  • Automation orchestrator soft-revokes refresh sessions by setting the revoked_at timestamp in the PostgreSQL database. A periodic cleanup worker deletes expired and revoked sessions.
  • The user cannot refresh their access token and must log in again.
  • Active access tokens remain valid until they expire (up to 15 minutes) because access tokens are stateless. Global token revocation forces all access tokens to be treated as stale, triggering an immediate refresh.
  • When you disable a user account, the middleware rejects that user's requests within 5 seconds. The response returns a 401 ACCOUNT_DISABLED error, closing the 15-minute stateless JWT window. Automation orchestrator exempts the /auth/logout endpoint so disabled users can still clean up their sessions.

Revoke global sessions

Revoke all sessions system-wide to force every user to re-authenticate.

Before you begin

  • You have admin permissions.

Procedure

  1. Navigate to System Administration > Access Management > Token Revocation.
  2. Select Revoke all tokens.
  3. In the Revoke all tokens? dialog, select the confirmation checkbox and select Revoke all tokens.

Revoke identity provider sessions

Revoke all sessions for users who authenticated through a specific identity provider.

Before you begin

  • You have admin permissions.

Procedure

  1. Navigate to System Administration > Identity Providers.
  2. Select the Options menu (⋮) on the row of an identity provider.
  3. Select the Revoke token option.
  4. In the confirmation dialog, select Confirm.

Revoke a user session

Revoke a specific user session to force the user to re-authenticate.

Before you begin

  • You have admin permissions.

Procedure

  1. Navigate to System Administration > Access Management > Users.
  2. Select the Options menu (⋮) on the row of a user.
  3. Select the Revoke token option.
  4. In the confirmation dialog, select Confirm.