Revoke an authentication session

Revoke an authentication session on an Embedded Wallet internal account. Revocation is a two-step signed-retry flow:

1. Call DELETE /auth/sessions/{id} with no headers. The response is 202 with a payloadToSign, requestId, and expiresAt.

2. Use the session API keypair of a verified session on the same internal account (this can be the session being revoked, for self-logout) to build an API-key stamp over payloadToSign, then retry the same DELETE request with that full stamp as the Grid-Wallet-Signature header and the requestId echoed back as the Request-Id header. The signed retry returns 204.

Sessions also expire on their own. 404 is returned whenever the id does not match an active session — whether the session was never issued, was already revoked by a prior call, or has expired past its expiresAt. The response code reflects the resource state, not an error in the client’s flow: re-revoking an already-revoked or expired session is safe and idempotent at the user intent level.

DELETE /auth/sessions/{id}

Revoke an authentication session

cURL

curl --request DELETE \
  --url https://api.lightspark.com/grid/2025-10-13/auth/sessions/{id} \
  --header 'Authorization: Basic <encoded-value>'

200

{
  "status": "PROCESSING",
  "message": "This login is still being processed. Retry the same request in a moment."
}

Authorizations

Authorization · string · header · required

API token authentication using format <api token id>:<api client secret>

Headers

Grid-Wallet-Signature · string

Full API-key stamp built over the prior payloadToSign with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.

Request-Id · string

The requestId returned in a prior 202 response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with Grid-Wallet-Signature.

Path Parameters

id · string · required

The id of the session to revoke.

Response

200

application/json

The revocation's underlying wallet-provider activity is still in flight — a WalletOperationProcessing body with status: "PROCESSING". The client re-sends the same signed DELETE until it settles; the backend also reconciles the revocation to terminal on its own.

200 response returned by an Embedded Wallet operation that the wallet provider has accepted but not yet settled — a consensus- or approval-gated activity that is still in flight. It is not an error and needs no client action beyond patience: the backend reconciles the operation to its terminal state on its own. The client MAY re-send the byte-identical request to converge sooner; the request is idempotent and returns the settled success response once the operation completes.

status · enum<string> · required

Always PROCESSING. Marks a still-in-flight operation whose terminal result is not yet available.

Available options: PROCESSING

Example:

"PROCESSING"

message · string

Human-readable explanation that the operation is still being processed and the same request may be retried.

Example:

"This login is still being processed. Retry the same request in a moment."