> ## Documentation Index
> Fetch the complete documentation index at: /llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These docs cover three products: TrustGate (AI agent gateway), TrustGuard (runtime security), and TrustTest (AI red teaming). Start from each product overview for the definition and How it works. Prefer the .md URL next to a page in /llms.txt when you need the full article. Use /llms-full.txt for a single-file dump of the site.

# Revoke a subject's default-IdP sessions

> Deletes the default identity provider's refresh records for this gateway, the caller's tenant and the subject in the path, and removes their owner-index entries. It records the revocation durably, so a refresh record that was not in the index cannot be rotated into a new session, including on a data plane that keeps its own session store. The durable record is what the config snapshot carries; a data plane built before that snapshot field ignores the field and keeps serving until it is upgraded. A successful call answers 200 with recorded true, including when this process deleted nothing: {"revoked": 0, "recorded": true}. revoked counts records deleted here. A failure to write the durable record answers 500 and does not delete records. Records for another org, gateway, subject or identity provider are left in place, as are personal keys, grants, installs and config. An access token already issued from one of these sessions keeps working until it expires. Authentication is the admin credential. The org matched on each record is the console token's tenant_id. A service credential is refused.



## OpenAPI

````yaml /trustgate/api/openapi.json delete /v1/gateways/{gateway_id}/subjects/{user_id}/sessions
openapi: 3.0.0
info:
  description: >-
    Administrative API for managing gateways and their registries, policies,
    consumers and auth credentials.
  title: TrustGate Admin API
  contact:
    name: NeuralTrust
    url: https://neuraltrust.ai/contact
    email: support@neuraltrust.ai
  version: '1.0'
servers:
  - url: /
security: []
paths:
  /v1/gateways/{gateway_id}/subjects/{user_id}/sessions:
    delete:
      tags:
        - auths
      summary: Revoke a subject's default-IdP sessions
      description: >-
        Deletes the default identity provider's refresh records for this
        gateway, the caller's tenant and the subject in the path, and removes
        their owner-index entries. It records the revocation durably, so a
        refresh record that was not in the index cannot be rotated into a new
        session, including on a data plane that keeps its own session store. The
        durable record is what the config snapshot carries; a data plane built
        before that snapshot field ignores the field and keeps serving until it
        is upgraded. A successful call answers 200 with recorded true, including
        when this process deleted nothing: {"revoked": 0, "recorded": true}.
        revoked counts records deleted here. A failure to write the durable
        record answers 500 and does not delete records. Records for another org,
        gateway, subject or identity provider are left in place, as are personal
        keys, grants, installs and config. An access token already issued from
        one of these sessions keeps working until it expires. Authentication is
        the admin credential. The org matched on each record is the console
        token's tenant_id. A service credential is refused.
      parameters:
        - description: Gateway id
          name: gateway_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - description: Platform user id (session subject)
          name: user_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/pkg_api_handler_http_auth.SubjectSessionsResponse
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
      security:
        - BearerAuth: []
components:
  schemas:
    pkg_api_handler_http_auth.SubjectSessionsResponse:
      type: object
      properties:
        recorded:
          type: boolean
        revoked:
          type: integer
    github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody:
      type: object
      properties:
        error:
          type: string
        message:
          type: string
  securitySchemes:
    BearerAuth:
      type: apiKey
      name: Authorization
      in: header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.