POSTSigned provider tokenAuthentication

Receive signed provider session revocation

/auth/backchannel-logout

OIDC back-channel logout form. Verifies the configured issuer, client audience, signature, expiry and logout event. Does not use browser cookies. Duplicate valid notifications are idempotent.

Authentication does not grant every action. Company scope, roles and current record access still apply. Protected writes require CSRF verification; company writes also require recent sign-in. Read the authentication guide.

Example request

// This endpoint is part of the identity-provider protocol.
// Start at /auth/login; do not construct callback or logout tokens.
// See the request fields and protocol description below.

Request parameters

No parameters declared in the contract.

Request body

Required body.

`application/x-www-form-urlencoded`

logout_token string · required: Signed OIDC logout token

Complete schema definition

{
  "properties": {
    "logout_token": {
      "description": "Signed OIDC logout token",
      "type": "string"
    }
  },
  "required": [
    "logout_token"
  ],
  "type": "object"
}

Responses

200 Matching sessions revoked or notification already applied

No response body declared.

400 Invalid logout token or form

No response body declared.

503 Revocation unavailable; provider should retry

No response body declared.

The default error response can cover several status codes. Read error handling and retry guidance.

Referenced schemas

Expand a named definition to inspect nested fields and references. The download contains the complete OpenAPI document.

Operation ID: browser-backchannel-logout · Contract 0.0.0-dev