Log out (server-side token revocation)
- Sandbox: available
- Staging: available
- Production: unknown
Signs the caller out on the server: the access token in the Authorization header stops working for every authenticated route, although it has not expired.
Auth: bearer token. A missing or invalid token gives 401.
Behaviour
- Ovok adds the token to a denylist. The entry lasts for the rest of the token's lifetime (its
expclaim), so the list never outgrows the set of live tokens. - Only this access token is revoked. The refresh token is not touched here; to end other sessions use
DELETE /auth/session/{option}. - The call is idempotent: repeating it with the same token returns 204 with no further effect. A token without an
expclaim, or one that has already expired, is ignored. - If the denylist store is unavailable the call still returns 204, and the token stays valid until it expires. Clear the local session as well.
- The response has no body (204 No Content).
- The route is available at both
/auth/logoutand/v1/auth/logout.
Example
curl -X POST 'https://api.sandbox.ovok.com/v1/auth/logout' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'Token was added to the revocation denylist. Returns 204 No Content.
curl -X POST 'https://api.sandbox.ovok.com/auth/logout'Log out (server-side token revocation) POST
Signs the caller out on the server: the access token in the `Authorization` header stops working for every authenticated route, although it has not expired. **Auth:** bearer token. A missing or invalid token gives 401. ## Behaviour - Ovok adds the token to a denylist. The entry lasts for the rest of the token's lifetime (its `exp` claim), so the list never outgrows the set of live tokens. - Only this access token is revoked. The refresh token is not touched here; to end other sessions use `DELETE /auth/session/{option}`. - The call is idempotent: repeating it with the same token returns 204 with no further effect. A token without an `exp` claim, or one that has already expired, is ignored. - If the denylist store is unavailable the call still returns 204, and the token stays valid until it expires. Clear the local session as well. - The response has no body (204 No Content). - The route is available at both `/auth/logout` and `/v1/auth/logout`. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/auth/logout' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```
Schedule user account deletion DELETE
Schedules deletion of the caller's own account. The account is not deleted right away: it stays until the scheduled date, and signing in again before then cancels the deletion. **Auth:** bearer token of the user who deletes their own account. **Scope:** the caller's own User, in the project of the token. ## Behaviour - `days` (0 to 90, default 30) sets how many days from now the account is due. `wipe` (default `false`) is recorded on the request. - Ovok signs the user out of all sessions, then records the deletion date on the User. Calling the route again resets the date. - A job runs every day at midnight. For each User whose date has passed, it deletes the project membership, the profile (Patient or Practitioner) and the User. - The job does not purge medical data yet, so `wipe` has no effect on what is deleted. - Ovok sends a confirmation email (`PATIENT_ACCOUNT_DELETION` for a Patient, `ACCOUNT_DELETION` otherwise). A failed email does not fail the request. - A successful login on the account (`POST /v2/auth/login`, or the tenant login routes) removes the scheduled deletion. - The response holds `scheduled` (the due date, ISO 8601) and the updated `user`, without its password hash. ## Example ```bash curl -X DELETE 'https://api.sandbox.ovok.com/auth/delete' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "days": 30, "wipe": false }' ```