Revoke JWTs

DELETE

/jwt/{id}

Last modified:2026-09-26 02:31:48

OperationId:RevokeJwt

Revokes JWTs by user or by token. The value in the path picks which, by its format: 40 lowercase letters and digits is a JWT ID (jti), and anything else is a user as user@domain. Revocation applies on this server at once and is published to the rest of the cluster. The call also clears the caller's ns_access_token and ns_refresh_token cookies.

Revoke one token by JTI

Send the token's jti claim, which GET /jwt returns. It works for access and refresh tokens. It requires a bearer token and oauth delete rights. An unknown JTI still returns success.

Revoke all tokens for a user

Send the user as user@domain. Every JWT issued to that user before this call is revoked, on every server. Tokens issued afterward stay valid, so this signs the user out everywhere without locking them out. Authenticate with an API key (Authorization: Bearer <key>): a JWT bearer returns 403. The key must be allowed to create tokens and must have oauth delete rights over the user.

Request

Authorization

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Path Params

Responses

🟢202Accepted

application/json

The tokens are revoked. The status comes from NsHttpStatusCodeSuccessDelete, which is 202 in the shipped configuration.

Bodyapplication/json

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location --request DELETE 'https://awqacore01.crexendocloud.com/ns-api/v2/jwt/0123456789abcdef0123456789abcdef01234567' \
--header 'Authorization: Bearer <token>'

Response Example

202 - Revoked

{
    "code": 202,
    "message": "Accepted"
}

Modified at 2026-09-26 02:31:48

Create JWT

Revoke current JWT

Revoke JWTs

Revoke one token by JTI#

Revoke all tokens for a user#

Request

Responses

Revoke one token by JTI

Revoke all tokens for a user