Revoke all other sessions
Revokes every active session for the current user except the one making this call. Requires aal2 (MFA-verified session). Sessions issued before per-session revocation (v=1 cookies) cannot identify themselves as “current” and receive 409 legacy_session_requires_reauth — the user must sign in again to use this action. See ADR-028.
Authorizations
HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with credentials: "include".
Headers
Optional idempotency key; repeated calls with the same key return the same result within 24 hours.
Response
Number of sessions revoked.
Count of sessions revoked (excludes the current session).