Logout

POST /auth/logout

Revoke the caller’s families, then take the browser’s copy away.

refresh_token=None is unchanged: this endpoint has always ended every family the principal holds, and which families a logout ends is a product decision, not a side effect of adding a cookie. What is new is the second half — a sign-out that revoked the session server-side and left a live cookie in the jar would restore the session on the next reload, which is worse than never having had the cookie.

Role floor

Requires viewer or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Responses

Status	Description	Body
204	Successful Response	—

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

curl -X POST https://your-deployment.example.com/auth/logout \
  -H "Authorization: Bearer $COBRE_TOKEN"