Logout of SAML

POST /_security/saml/logout

Submits a request to invalidate an access token and refresh token.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

This API invalidates the tokens that were generated for a user by the SAML authenticate API. If the SAML realm in Elasticsearch is configured accordingly and the SAML IdP supports this, the Elasticsearch response contains a URL to redirect the user to the IdP that contains a SAML logout request (starting an SP-initiated SAML Single Logout).

More about SAML authentication

Request

Response

application/json

Examples

Run POST /_security/saml/logout to invalidate the pair of tokens that were generated by calling the SAML authenticate API with a successful SAML response.

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST /_security/saml/logout
{
  "token" : "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
  "refresh_token" : "mJdXLtmvTUSpoLwMvdBt_w"
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.samlLogout({
  token: "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
  refresh_token: "mJdXLtmvTUSpoLwMvdBt_w",
});

Python Elasticsearch Python Client

resp = client.security.saml_logout(
    token="46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    refresh_token="mJdXLtmvTUSpoLwMvdBt_w",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/saml/logout" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    "refresh_token": "mJdXLtmvTUSpoLwMvdBt_w"
  }'

Java Elasticsearch Java Client

client.security().samlLogout(s -> s
    .refreshToken("mJdXLtmvTUSpoLwMvdBt_w")
    .token("46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .SamlLogoutAsync(d1 => d1
        .RefreshToken("mJdXLtmvTUSpoLwMvdBt_w")
        .Token("46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->samlLogout([
    "body" => [
        "token" => "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
        "refresh_token" => "mJdXLtmvTUSpoLwMvdBt_w",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.saml_logout(
  body: {
    "token": "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    "refresh_token": "mJdXLtmvTUSpoLwMvdBt_w"
  }
)

Response

{
  "redirect" : "https://my-idp.org/logout/SAMLRequest=...."
}

Request { token , refresh_token , }

Response

Request