Back to API Practice

Security/Auth trainer

Device Sessions API Practice

Practice active device lists, session revocation, revoke-all behavior, token invalidation, unknown devices, suspicious sessions, and auditability.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated POST /api/auth/sessions/{sessionId}/revoke request, inspect the fake response, and turn it into test ideas.

Session IDs and tokens are fake local examples only and are not sent anywhere.

Request

Build the request

POST/api/auth/sessions/{sessionId}/revoke

Request JSON

application/json
{
  "operation": "list"
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Revoke

Validation

Permissions

Idempotency

Reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List active sessions, revoke one device, revoke all other devices, current session behavior, unknown session, duplicate revoke, another user's session, refresh token invalidation, stale metadata, CSRF, logs, and outages.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Device Sessions endpoint

List and revoke device sessions while invalidating tokens and protecting account security state.

Endpoint

POST/api/auth/sessions/{sessionId}/revoke

Purpose

List and revoke device sessions while invalidating tokens and protecting account security state.

Request fields

  • sessionId: session identifier, required for single revoke
  • scope: single-device | all-other-devices
  • currentSessionPolicy: product-specific
  • csrfToken: required for cookie auth

Success response

204 No Content

Request body

{
  "sessionId": "sess_laptop_123",
  "scope": "single-device"
}

Example response body

{
  "status": "revoked",
  "revokedSessionId": "sess_laptop_123"
}

Errors

  • 400 malformed session ID
  • 401 unauthorized
  • 403 another user's session
  • 404 unknown session
  • 409 already revoked
  • 503 session store unavailable

Security notes

  • Revoked refresh tokens cannot create new sessions
  • Session IDs and tokens are never logged
  • Another user's sessions are inaccessible
  • Revoke actions are audited

Business rules

  • List returns only caller sessions
  • Revoke one session updates list
  • Revoke all other devices preserves or ends current session according to policy
  • Duplicate revokes are idempotent or safely rejected