> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.mercoa.com/embedded-ap-ar/api-reference/organization/invalidate-tokens/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.mercoa.com/_mcp/server.

# Invalidate Tokens

POST https://api.mercoa.com/organization/invalidateTokens
Content-Type: application/json

Invalidate all JWT tokens for the current organization. This is considered a break-glass action and should be used only if tokens have been compromised. All tokens will be invalidated, including tokens on links, emails, and currently logged in sessions. API keys are not affected by this action. This action may take 60 seconds to propagate.

Reference: https://docs.mercoa.com/embedded-ap-ar/api-reference/organization/invalidate-tokens

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Request

### Body (application/json)

This endpoint expects an object.

- `sessionId` (list of string, optional) — Optional list of session IDs to invalidate. If not provided, all sessions will be invalidated.

## Errors

### 400 Bad Request

- `errorName` ("BadRequest", required)
- `content` (string, required)

### 401 Unauthorized

- `errorName` ("Unauthorized", required)
- `content` (string, required)

### 403 Forbidden

- `errorName` ("Forbidden", required)
- `content` (string, required)

### 404 Not Found

- `errorName` ("NotFound", required)
- `content` (string, required)

### 409 Conflict

- `errorName` ("Conflict", required)
- `content` (string, required)

### 500 Internal Server Error

- `errorName` ("InternalServerError", required)
- `content` (string, required)

### 501 Unimplemented

- `errorName` ("Unimplemented", required)
- `content` (string, required)

## Examples

### Sessions

**Request**

```json
{
  "sessionId": [
    "session_123",
    "session_456"
  ]
}
```

**SDK Code**

```python Sessions
import requests

url = "https://api.mercoa.com/organization/invalidateTokens"

payload = { "sessionId": ["session_123", "session_456"] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```typescript Sessions
import { MercoaClient } from "@mercoa/javascript";

const client = new MercoaClient({ token: "YOUR_TOKEN" });
await client.organization.invalidateTokens({
    sessionId: ["session_123", "session_456"]
});

```

```go Sessions
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.mercoa.com/organization/invalidateTokens"

	payload := strings.NewReader("{\n  \"sessionId\": [\n    \"session_123\",\n    \"session_456\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Sessions
require 'uri'
require 'net/http'

url = URI("https://api.mercoa.com/organization/invalidateTokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"sessionId\": [\n    \"session_123\",\n    \"session_456\"\n  ]\n}"

response = http.request(request)
puts response.read_body
```

```java Sessions
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.mercoa.com/organization/invalidateTokens")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"sessionId\": [\n    \"session_123\",\n    \"session_456\"\n  ]\n}")
  .asString();
```

```php Sessions
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.mercoa.com/organization/invalidateTokens', [
  'body' => '{
  "sessionId": [
    "session_123",
    "session_456"
  ]
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Sessions
using RestSharp;

var client = new RestClient("https://api.mercoa.com/organization/invalidateTokens");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"sessionId\": [\n    \"session_123\",\n    \"session_456\"\n  ]\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Sessions
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["sessionId": ["session_123", "session_456"]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.mercoa.com/organization/invalidateTokens")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### All Sessions

**Request**

```json
{
  "sessionId": null
}
```

**SDK Code**

```python All Sessions
import requests

url = "https://api.mercoa.com/organization/invalidateTokens"

payload = { "sessionId": None }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```typescript All Sessions
import { MercoaClient } from "@mercoa/javascript";

const client = new MercoaClient({ token: "YOUR_TOKEN" });
await client.organization.invalidateTokens();

```

```go All Sessions
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.mercoa.com/organization/invalidateTokens"

	payload := strings.NewReader("{\n  \"sessionId\": null\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby All Sessions
require 'uri'
require 'net/http'

url = URI("https://api.mercoa.com/organization/invalidateTokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"sessionId\": null\n}"

response = http.request(request)
puts response.read_body
```

```java All Sessions
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.mercoa.com/organization/invalidateTokens")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"sessionId\": null\n}")
  .asString();
```

```php All Sessions
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.mercoa.com/organization/invalidateTokens', [
  'body' => '{
  "sessionId": null
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp All Sessions
using RestSharp;

var client = new RestClient("https://api.mercoa.com/organization/invalidateTokens");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"sessionId\": null\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift All Sessions
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["sessionId": ] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.mercoa.com/organization/invalidateTokens")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```