---
type: api
title: Logout of SAML
description: Submits a request to invalidate an access token and refresh token.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-security-saml-logout
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-security-saml-logout
products:
  - Elasticsearch
---

# Logout of SAML

Availability: 7.5+

## Paths

- `POST` `/_security/saml/logout`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#bearerauth)

## Description

Submits a request to invalidate an access token and refresh token.

NOTE: This API is intended for use by custom web applications other than Kibana.
If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

This API invalidates the tokens that were generated for a user by the SAML authenticate API.
If the SAML realm in Elasticsearch is configured accordingly and the SAML IdP supports this, the Elasticsearch response contains a URL to redirect the user to the IdP that contains a SAML logout request (starting an SP-initiated SAML Single Logout).

[More about SAML authentication](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/saml)

## Request Body

`application/json`

- `token` (string) — required
  The access token that was returned as a response to calling the SAML authenticate API.
Alternatively, the most recent token that was received after refreshing the original one by using a `refresh_token`.
- `refresh_token` (string) — optional
  The refresh token that was returned as a response to calling the SAML authenticate API.
Alternatively, the most recent refresh token that was received after refreshing the original access token.

## Response

`application/json`

- `redirect` (string)
  A URL that contains a SAML logout request as a parameter.
You can use this URL to be redirected back to the SAML IdP and to initiate Single Logout.
## Code Examples

#### Console

```console
POST /_security/saml/logout
{
  "token" : "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
  "refresh_token" : "mJdXLtmvTUSpoLwMvdBt_w"
}
```

#### JavaScript

```javascript
const response = await client.security.samlLogout({
  token: "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
  refresh_token: "mJdXLtmvTUSpoLwMvdBt_w",
});
```

#### Python

```python
resp = client.security.saml_logout(
    token="46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    refresh_token="mJdXLtmvTUSpoLwMvdBt_w",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_security/saml/logout" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    "refresh_token": "mJdXLtmvTUSpoLwMvdBt_w"
  }'
```

#### Java

```java
client.security().samlLogout(s -> s
    .refreshToken("mJdXLtmvTUSpoLwMvdBt_w")
    .token("46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3")
);
```

#### C#

```c#
var response = await client.Security
    .SamlLogoutAsync(d1 => d1
        .RefreshToken("mJdXLtmvTUSpoLwMvdBt_w")
        .Token("46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3")
    );
```

#### PHP

```php
$resp = $client->security()->samlLogout([
    "body" => [
        "token" => "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
        "refresh_token" => "mJdXLtmvTUSpoLwMvdBt_w",
    ],
]);
```

#### Ruby

```ruby
response = client.security.saml_logout(
  body: {
    "token": "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    "refresh_token": "mJdXLtmvTUSpoLwMvdBt_w"
  }
)
```

## Response Examples

#### Saml logout response example1

A successful response from `POST /_security/saml/logout`.

```json
{
  "redirect" : "https://my-idp.org/logout/SAMLRequest=...."
}
```