Logout of SAML

POST /_security/saml/logout

Submits a request to invalidate an access token and refresh token.

Note

This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

This API invalidates the tokens that were generated for a user by the SAML authenticate API. If the SAML realm in Elasticsearch is configured accordingly and the SAML IdP supports this, the Elasticsearch response contains a URL to redirect the user to the IdP that contains a SAML logout request (starting an SP-initiated SAML Single Logout).

More about SAML authentication

Authentication

Api key

Authorization: <value>

Elasticsearch APIs support key-based authentication. You must create an API key and use the encoded value in the request header. For example:

		curl -X GET "${ES_URL}/_cat/indices?v=true" \
  -H "Authorization: ApiKey ${API_KEY}"

To get API keys, use the /_security/api_key APIs.

Basic

Authorization: Basic <credentials>

Bearer

Authorization: Bearer <token>

Elasticsearch APIs support the use of bearer tokens in the Authorization HTTP header to authenticate with the API. For examples, refer to Token-based authentication services

Request body

Response

application/json

Examples

Request Console 1 / 8 languages

Run POST /_security/saml/logout to invalidate the pair of tokens that were generated by calling the SAML authenticate API with a successful SAML response.

Console Kibana Dev Tools

POST /_security/saml/logout
{
  "token" : "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
  "refresh_token" : "mJdXLtmvTUSpoLwMvdBt_w"
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.samlLogout({
  token: "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
  refresh_token: "mJdXLtmvTUSpoLwMvdBt_w",
});

Python Elasticsearch Python Client

resp = client.security.saml_logout(
    token="46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    refresh_token="mJdXLtmvTUSpoLwMvdBt_w",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/saml/logout" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    "refresh_token": "mJdXLtmvTUSpoLwMvdBt_w"
  }'

Java Elasticsearch Java Client

client.security().samlLogout(s -> s
    .refreshToken("mJdXLtmvTUSpoLwMvdBt_w")
    .token("46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .SamlLogoutAsync(d1 => d1
        .RefreshToken("mJdXLtmvTUSpoLwMvdBt_w")
        .Token("46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->samlLogout([
    "body" => [
        "token" => "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
        "refresh_token" => "mJdXLtmvTUSpoLwMvdBt_w",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.saml_logout(
  body: {
    "token": "46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3",
    "refresh_token": "mJdXLtmvTUSpoLwMvdBt_w"
  }
)

Response

A successful response from POST /_security/saml/logout.

{
  "redirect" : "https://my-idp.org/logout/SAMLRequest=...."
}

Authentication

Request body { }

Response

Request body