FruxonDocs
UsersCore

Sign out everywhere.

Ends every console session the caller has begun, on every device, including the one making this call. From then on the API answers any of those sessions with `401 {"error": "session_revoked"}`, and Firebase stops refreshing them. The caller should sign out locally when this succeeds; signing in again starts a session that is unaffected. Takes effect at once on the instance that answers, and on every other API instance within a minute. Personal access tokens and CLI keys are not affected: revoke those on their own page. Call it on the bootstrap host, like the rest of `users/me`. A 5xx after the revocation was recorded means Firebase could not be confirmed to have stopped refreshing the old sessions. The API refuses them regardless, but the caller's own session is refused too, so to complete the revocation, sign in again and repeat the call. The later instant covers the earlier one.

POST
/v1/users/me:revokeSessions

Authorization

Bearer
AuthorizationBearer <token>

JWT Authorization header using the Bearer scheme. Enter 'Bearer' [space] and then your token.

In: header

Response Body

curl -X POST "https://api.fruxon.com/v1/users/me:revokeSessions"
{
  "sessionsValidAfter": 0
}
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}

Update the current user's profile.

Partial update — only the fields present in the request body are applied; omitted fields remain unchanged. Use this for first-name / last-name / avatar changes triggered from the in-app profile settings. The caller can only mutate their own profile; identity is taken from the Firebase ID token, not from any path parameter.

Get what the current user must accept, and whether they have.

Called on sign-in. `accepted: false` is the signal to show the acceptance prompt; nothing else needs to be interpreted. An environment with no published document set configured reports `accepted: true` with no documents, so a missing configuration cannot lock anyone out.