---
type: api
title: Invalidate user sessions
description: Invalidate user sessions that match a query. To use this API, you must be a superuser.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-post-security-session-invalidate
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-post-security-session-invalidate
products:
  - Kibana
---

# Invalidate user sessions

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/security/session/_invalidate`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

## Description

Invalidate user sessions that match a query. To use this API, you must be a superuser.

## Request Body

`application/json`

- `match` (enum) — required
  The method Kibana uses to determine which sessions to invalidate. If it is `all`, all existing sessions will be invalidated. If it is `query`, only the sessions that match the query will be invalidated.
  Values: `all`, `query`
- `query` (object) — optional
  The query that Kibana uses to match the sessions to invalidate when the `match` parameter is set to `query`.
  - `provider` (object) — required
    The authentication providers that will have their user sessions invalidated.
    - `name` (string) — optional
      The authentication provider name.
    - `type` (string) — required
      The authentication provide type. For example: `basic`, `token`, `saml`, `oidc`, `kerberos`, or `pki`.
  - `username` (string) — optional
    The username that will have its sessions invalidated.

## Responses

#### `200`

Indicates a successful call

`application/json`

- `total` (integer)
  The number of sessions that were successfully invalidated.
#### `403`

Indicates that the user may not be authorized to invalidate sessions for other users.

## Code Examples

#### Console

```console
POST /api/security/session/_invalidate
{
  "match" : "all"
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/security/session/_invalidate" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "match" : "all"
}'
```