`delete_users_by_id_sessions`

Changes data · you confirm first Idempotent

Calls DELETE /api/users/{id}/sessions as the signed-in person · REST reference

Force-logout a user — end every session they hold

Containment for a compromised or departing account. Ends BOTH kinds of session the platform issues, because they live in two stores and one call cannot reach both: login sessions are rows in the DynamoDB pff_auth_sessions table (invalidateAllUserSessions), and impersonation sessions are Neo4j :ImpersonationSession nodes (terminateAllUserImpersonationSessions). Both are re-read by middleware/auth.ts on every authenticated request, so each token 401s on its next call rather than at its 24h exp. IDEMPOTENT: an already-invalidated login session is not listed and an already-terminated impersonation row is not matched, so a retry after a partial failure completes the containment rather than double-counting it. Targeting yourself is allowed and logs you out — the caller's own bearer is forwarded to the DAL for this request, so it completes before the revocation bites. It does NOT deactivate the account. The user can sign in again with a fresh one-time code; pair it with DELETE /api/users/{id} to keep them out (PUT /api/users/{id} does not accept status).

Arguments

Argument	Type		Description
`id`path	string (uuid)	required	The user whose sessions are ended.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "delete_users_by_id_sessions",
    "arguments": {
      "id": "11111111-1111-4111-8111-111111111111"
    }
  }
}

Confirmation

The client shows the person the exact request and waits. Nothing runs until they tick Make this change. See Reading and changing.

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

Every session the user held has been ended.

json

{
  "impersonationSessionsTerminated": 1,
  "message": "string"
}

Fields

Field	Type	Description
`impersonationSessionsTerminated`	integer	`:ImpersonationSession` rows moved out of ACTIVE — those the user was the target of AND those they opened against others. Login sessions carry no count: the DAL mutation answers a bare success payload.
`message`	string

When it fails

A failed call returns isError: true with the API's message as text. A change the person declines, or lets time out, also comes back this way and nothing changes.

403: Authenticated, but the caller holds none of the required permissions.
404: No such user.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "delete_users_by_id_sessions",
  "description": "DELETE /api/users/{id}/sessions — Containment for a compromised or departing account. Ends BOTH kinds of session the platform issues, because they live in two stores and one call cannot reach both: login sessions are rows in the DynamoDB `pff_auth_sessions` table (`invalidateAllUserSessions`), and impersonation sessions are Neo4j `:ImpersonationSession` nodes (`terminateAllUserImpersonationSessions`). Both are re-read by `middleware/auth.ts` on every authenticated request, so each token 401s on its next call rather than at its 24h `exp`.\nIDEMPOTENT: an already-invalidated login session is not listed and an already-terminated impersonation row is not matched, so a retry after a partial failure completes the containment rather than double-counting it.\nTargeting yourself is allowed and logs you out — the caller's own bearer is forwarded to the DAL for this request, so it completes before the revocation bites.\nIt does NOT deactivate the account. The user can sign in again with a fresh one-time code; pair it with `DELETE /api/users/{id}` to keep them out (`PUT /api/users/{id}` does not accept `status`).\n\nThis changes data. The person is asked to confirm it before it runs, and nothing happens if they decline.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "id": {
        "type": "string",
        "description": "The user whose sessions are ended."
      }
    },
    "required": [
      "id"
    ]
  },
  "annotations": {
    "readOnlyHint": false,
    "destructiveHint": true,
    "idempotentHint": true,
    "openWorldHint": false
  }
}