> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cube.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke an embed session

**🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.

Ends an embed session from the server side — call it from your application's logout handler. Pass the `sessionId` that `POST /api/v1/embed/generate-session` returned.

Works in either state the session can be in: an id that has not been exchanged yet can no longer be redeemed via `POST /api/v1/embed/session/token`, and the token an already-exchanged id produced is rejected with `401` from this moment on. The embedded iframe does not tear itself down — remove it on logout as before.

Idempotent: revoking an unknown, expired or already-revoked id also responds `204` — so the response alone never tells you whether a token was still revocable. That depends on Cube, not on the client library you call from: only tokens Cube issued after this endpoint shipped carry the claim revocation is checked against, and an older token keeps working until it expires on its own, within 24 hours. A Cube API token the embed obtained from `POST /api/v1/deployments/{deploymentId}/token` is a separate credential and is not affected.

Embedding must be enabled for the account, otherwise `403` is returned.


## OpenAPI

````yaml /api-reference/api.yaml post /api/v1/embed/session/revoke
openapi: 3.1.0
info:
  title: Cube Platform API
  version: 1.0.0
  description: >-
    Programmatically manage Cube: deployments and everything scoped to them

    (environments, folders, reports, workbooks, notifications, workspace, and
    agents),

    plus account-level users, groups, policies, embedding, and AI settings.
    Data-model

    authoring, dev mode, branches, and uploads live under /build/api/v1 — same
    host and

    token, routed to the build pods.
servers:
  - url: https://{tenant}.cubecloud.dev
    description: Your tenant host. Replace the whole host if you use a custom domain.
    variables:
      tenant:
        default: your-tenant
        description: Your Cube tenant subdomain
security:
  - bearerAuth: []
tags:
  - name: Deployments
  - name: Deployment Creation
  - name: Environments
  - name: Env Variables
  - name: Regions
  - name: Data Model
  - name: Data Model Uploads
  - name: GitHub
  - name: GitHub Connection
  - name: dbt Sync
  - name: Databricks Metric View Publication
  - name: Databricks Metric View Integration
  - name: Folders
  - name: Reports
  - name: Workbooks
  - name: Dashboard Exports
  - name: Notifications
  - name: Workspace
  - name: Users
  - name: Users Admin
  - name: User Attributes
  - name: User Attribute Values
  - name: Tenant Settings
  - name: OAuth Integrations
  - name: User OAuth Tokens
  - name: OIDC Token Configs
  - name: App Theme
  - name: Embed
  - name: Embed Tenants
  - name: Dashboard Embed Access
  - name: Usage Analytics
  - name: OpenAPI Spec
paths:
  /api/v1/embed/session/revoke:
    post:
      tags:
        - Embed
      summary: Revoke an embed session
      operationId: revokeSession
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeEmbedSessionInput'
        description: RevokeEmbedSessionInput
        required: false
      responses:
        '200':
          content:
            application/json: {}
          description: Successful response
        '204':
          description: Session revoked, or did not exist.
components:
  schemas:
    RevokeEmbedSessionInput:
      properties:
        sessionId:
          description: >-
            The session id returned by `POST /api/v1/embed/generate-session`.
            Works whether or not the session has already been exchanged for a
            token.
          pattern: ^[0-9a-f]{32}$
          type: string
      required:
        - sessionId
      type: object
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Token authentication. Send `Authorization: Bearer <YOUR_TOKEN>`.'

````