Revoke a specific session
Revokes one non-current session by its sid. The KV blocklist is updated so the gateway rejects the next request bearing that session on its next hit. Cannot be used to revoke the session making this request — use POST /auth/sign-out for that. Requires aal2. Idempotent: a sid that is already revoked or never belonged to the user returns 404 (non-enumeration). See ADR-028.
Authorizations
HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with credentials: "include".
Path Parameters
Session identifier returned by GET /auth/sessions.
Response
Session revoked.