Revoke the Session Token
Take the widget token away from the session: no link opens it any more.
Use it the moment a link must stop working — your customer finished on your own screens, the case was closed, a link went somewhere it should not have —, whether the session is open, closed or already deleted. The session itself is untouched: you still follow it, read its results, cancel it and delete it as before.
Key technical details:
- No request body. No body in the answer either.
- Idempotency (
304). A session with no token is left as it is — revoking twice is safe. - Concurrency lock (
504). Revoking holds the session; if it cannot within a few seconds, retry.
Revoking is not final while the session is open. Issue a Session Token whenever your customer needs the widget again: it gets a new token and a new link. Deleting the session does not take its token: your customer keeps its last screen until the session’s date_limit. Revoke it whenever a link must stop working — before or after the deletion: this call still finds a deleted session.
This endpoint needs to be executed with an app secret, so should always be used in server side without exposing the secret to customers.
Authentication
Path parameters
Response
204 No Content
Revoked