RP-Initiated Logout (OpenID Connect)

GET/end_session

Logs the end user out at the OP. If a valid, exactly-registered post_logout_redirect_uri is supplied, the OP redirects the user agent there with state appended; otherwise a logged-out page is shown. The OP never redirects to an unregistered URI.

Authorization

None. This endpoint does not take API credentials.

It reads the browser session from the Cookie header.

The request Cookie header; the interactive login / pending-auth session cookie, and the browser marker a sign-in is recognized by, are read from it.

Query parameters

id_token_hintstring
A previously issued ID token identifying the session to end.
logout_hintstring
client_idstring
post_logout_redirect_uristring · uri
Must exactly match a pre-registered post-logout redirect URI.
statestring
ui_localesstring

Headers

Cookiestring
The request Cookie header; the interactive login / pending-auth session cookie, and the browser marker a sign-in is recognized by, are read from it.

Responses

200 OKtext/htmlThe front-channel logout page: one <iframe> per participating relying party, plus a redirect to the post-logout target. Served instead of the 302 only when a participating client registered a frontchannel_logout_uri.
The front-channel logout page: one <iframe> per participating relying party, plus a redirect to the post-logout target. Served instead of the 302 only when a participating client registered a frontchannel_logout_uri.

Delivery through this page is BEST EFFORT and unverifiable — the frames are cross-origin, so the OP can read neither their status nor their body, and §4.1 warns that a browser blocking third-party content will keep the RP from seeing its own cookies at all. Back-Channel Logout 1.0 is the mechanism that actually confirms anything.
Headers
- Set-Cookiearray of strings
- Cache-Controlno-store
- Pragmano-cache
- Content-Security-Policydefault-src 'none'; style-src 'unsafe-inline'; frame-src https: http:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'Locks the logout page down to inline styles and cross-origin frames.
302 FoundRedirect to the validated post_logout_redirect_uri (or the hosted UI), with the session cookie cleared.
Redirect to the validated post_logout_redirect_uri (or the hosted UI), with the session cookie cleared.
Headers
- Locationstring
- Set-Cookiearray of strings
- Cache-Controlno-store
- Pragmano-cache
429 Too Many Requestsapplication/problem+jsonToo many requests.
Too many requests.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
Errorapplication/jsonOAuth2 error response (RFC 6749 §5.2).
OAuth2 error response (RFC 6749 §5.2).
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
An OAuth2 error response (RFC 6749 §5.2). iss (RFC 9207) is present on authorization-endpoint error responses so clients can detect mix-up.
- errorstringrequired
  A single ASCII error code.
  Example"invalid_request"
- error_descriptionstring
  Example"client_id, redirect_uri and response_type are required"
- error_uristring · uri
- statestring
  Echoed authorization-request state (RFC 6749 §4.1.2.1).
- issstring · uri
  Issuer identifier on authorization error responses (RFC 9207).

PreviousOpenID Connect UserInfo endpoint (POST)NextRP-Initiated Logout, form-encoded

RP-Initiated Logout (OpenID Connect)

GET/end_session

Session cookie Rate limited

Authorization

None. This endpoint does not take API credentials.

It reads the browser session from the Cookie header.

The request Cookie header; the interactive login / pending-auth session cookie, and the browser marker a sign-in is recognized by, are read from it.

Query parameters

id_token_hintstring
A previously issued ID token identifying the session to end.
logout_hintstring
client_idstring
post_logout_redirect_uristring · uri
Must exactly match a pre-registered post-logout redirect URI.
statestring
ui_localesstring

Headers

Cookiestring
The request Cookie header; the interactive login / pending-auth session cookie, and the browser marker a sign-in is recognized by, are read from it.

Responses

200 OKtext/htmlThe front-channel logout page: one <iframe> per participating relying party, plus a redirect to the post-logout target. Served instead of the 302 only when a participating client registered a frontchannel_logout_uri.
The front-channel logout page: one <iframe> per participating relying party, plus a redirect to the post-logout target. Served instead of the 302 only when a participating client registered a frontchannel_logout_uri.

Delivery through this page is BEST EFFORT and unverifiable — the frames are cross-origin, so the OP can read neither their status nor their body, and §4.1 warns that a browser blocking third-party content will keep the RP from seeing its own cookies at all. Back-Channel Logout 1.0 is the mechanism that actually confirms anything.
Headers
- Set-Cookiearray of strings
- Cache-Controlno-store
- Pragmano-cache
- Content-Security-Policydefault-src 'none'; style-src 'unsafe-inline'; frame-src https: http:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'Locks the logout page down to inline styles and cross-origin frames.
302 FoundRedirect to the validated post_logout_redirect_uri (or the hosted UI), with the session cookie cleared.
Redirect to the validated post_logout_redirect_uri (or the hosted UI), with the session cookie cleared.
Headers
- Locationstring
- Set-Cookiearray of strings
- Cache-Controlno-store
- Pragmano-cache
429 Too Many Requestsapplication/problem+jsonToo many requests.
Too many requests.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
Errorapplication/jsonOAuth2 error response (RFC 6749 §5.2).
OAuth2 error response (RFC 6749 §5.2).
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
An OAuth2 error response (RFC 6749 §5.2). iss (RFC 9207) is present on authorization-endpoint error responses so clients can detect mix-up.
- errorstringrequired
  A single ASCII error code.
  Example"invalid_request"
- error_descriptionstring
  Example"client_id, redirect_uri and response_type are required"
- error_uristring · uri
- statestring
  Echoed authorization-request state (RFC 6749 §4.1.2.1).
- issstring · uri
  Issuer identifier on authorization error responses (RFC 9207).

PreviousOpenID Connect UserInfo endpoint (POST)NextRP-Initiated Logout, form-encoded

Headers

Headers

Body

Headers

Body

Headers

Headers

Body

Headers

Body