Skip to navigation
Sare Core APIIdentity

Logout

View as Markdown

auth/** is whitelisted for Bearer EXCEPT logout/refresh-token - these two need a valid Bearer token; body is read from the request/cookie context, no explicit request body.

Headers

AuthorizationstringOptional
X-Device-IdstringOptional

Required on non-GET requests to non-public paths (DeviceSignatureFilter), skipped for GET/whitelisted/multipart requests and in the local profile.

X-SignaturestringOptional

Base64 ECDSA signature over sha256(body) + timestamp + requestId, signed with the device's registered private key.

X-TimestampstringOptional

Unix epoch seconds; must be within 5 minutes of server time.

X-Request-IdstringOptional

Unique per request - reused values are rejected as replays.

Response

200 OK
codeintegerOptional
messagestringOptional