> ## Documentation Index
> Fetch the complete documentation index at: https://docs.capedigital.co.ke/llms.txt
> Use this file to discover all available pages before exploring further.

# Logout and invalidate tokens

> Logout user with immediate token invalidation.

This performs a complete logout:
1. Adds access token to blacklist (immediate invalidation)
2. Revokes the refresh token (prevents getting new access tokens)
3. Terminates all Keycloak sessions for the user

After logout, the access token is immediately invalid on all subsequent requests.



## OpenAPI

````yaml /openapi/user.yaml post /api/v1/auth/logout
openapi: 3.0.3
info:
  title: CapeMedia User Service API
  version: 1.0.0
  description: |2-

        **CapeMedia User Service API** - Comprehensive user service and management system.

        ## Authentication
        This API uses **JWT Bearer tokens** for authentication.

        1. Login via `/api/v1/auth/login` to obtain tokens
        2. Include the access token in the `Authorization` header: `Bearer <access_token>`
        3. Refresh expired tokens via `/api/v1/auth/refresh-token`

        ## Versioning
        The API uses URL path versioning (e.g., `/api/v1/`, `/api/v2/`).
        Current version: **v1**
        
  contact:
    name: API Support
    email: support@capemedia.co.ke
  license:
    name: Cape Media
servers:
  - url: https://api.diginacape.co.ke/acl
    description: Production
  - url: http://localhost:8000
    description: Local
security: []
paths:
  /api/v1/auth/logout:
    post:
      tags:
        - Authentication
      summary: Logout and invalidate tokens
      description: >-
        Logout user with immediate token invalidation.


        This performs a complete logout:

        1. Adds access token to blacklist (immediate invalidation)

        2. Revokes the refresh token (prevents getting new access tokens)

        3. Terminates all Keycloak sessions for the user


        After logout, the access token is immediately invalid on all subsequent
        requests.
      operationId: auth_logout
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefreshTokenRequestRequest'
            examples:
              RefreshToken:
                value:
                  refresh_token: eyJhbGciOiJSUzI1NiJ9...
                  realm: capemedia
                summary: Refresh token
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RefreshTokenRequestRequest'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/RefreshTokenRequestRequest'
        required: true
      responses:
        '200':
          description: No response body
      security:
        - bearerAuth: []
        - {}
components:
  schemas:
    RefreshTokenRequestRequest:
      type: object
      properties:
        refresh_token:
          type: string
          minLength: 1
          description: Refresh token to invalidate
        realm:
          type: string
          minLength: 1
          default: capemedia
          description: Keycloak realm name. Must match the realm used at login.
      required:
        - refresh_token
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Enter your JWT token in the format: Bearer <token>'

````