Elastic Stack (ELK Stack) user session API

openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana user session API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: User Session
  x-displayName: User session management
  description: Enables you to invalidate user sessions for security and session management purposes.
paths:
  /api/security/session/_invalidate:
    post:
      description: Invalidate user sessions that match a query. To use this API, you must be a superuser.
      operationId: post-security-session-invalidate
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              invalidateRequestExample1:
                description: Run `POST api/security/session/_invalidate` to invalidate all existing sessions.
                summary: Invalidate all sessions
                value: "{\n  \"match\" : \"all\"\n}"
              invalidateRequestExample2:
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any SAML authentication provider.
                summary: Invalidate all SAML sessions
                value: "{\n  \"match\" : \"query\",\n  \"query\": {\n    \"provider\" : { \"type\": \"saml\" }\n  }\n}"
              invalidateRequestExample3:
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by the SAML authentication provider named `saml1`.
                summary: Invalidate sessions for a provider
                value: "{\n  \"match\" : \"query\",\n  \"query\": {\n    \"provider\" : { \"type\": \"saml\", \"name\": \"saml1\" }\n  }\n}"
              invalidateRequestExample4:
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any OpenID Connect authentication provider for the user with the username `user@my-oidc-sso.com`.
                summary: Invalidate sessions for a user
                value: "{\n  \"match\" : \"query\",\n  \"query\": {\n    \"provider\" : { \"type\": \"oidc\" },\n    \"username\": \"user@my-oidc-sso.com\"\n  }\n}"
            schema:
              type: object
              properties:
                match:
                  description: 'The method Kibana uses to determine which sessions to invalidate. If it is `all`, all existing sessions will be invalidated. If it is `query`, only the sessions that match the query will be invalidated.

                    '
                  enum:
                  - all
                  - query
                  type: string
                query:
                  description: 'The query that Kibana uses to match the sessions to invalidate when the `match` parameter is set to `query`.

                    '
                  type: object
                  properties:
                    provider:
                      description: The authentication providers that will have their user sessions invalidated.
                      type: object
                      properties:
                        name:
                          description: The authentication provider name.
                          type: string
                        type:
                          description: 'The authentication provide type. For example: `basic`, `token`, `saml`, `oidc`, `kerberos`, or `pki`.

                            '
                          type: string
                      required:
                      - type
                    username:
                      description: The username that will have its sessions invalidated.
                      type: string
                  required:
                  - provider
              required:
              - match
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    description: The number of sessions that were successfully invalidated.
                    type: integer
          description: Indicates a successful call
        '403':
          description: Indicates that the user may not be authorized to invalidate sessions for other users.
      summary: Invalidate user sessions
      tags:
      - User Session
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"