Receive provider logout

Identity-provider notification endpoint. Validates the signed logout_token, issuer, audience, session ID, event, age and jti. No panel cookie is required; an unsigned request is not authorized. Valid repeated notifications are idempotent.

POST /api/v1/auth/backchannel-logout

Operation: backchannelLogout · Download OpenAPI

Access

This operation does not use the panel session as its authentication mechanism. Follow the operation-specific checks described above.

Parameters

No explicit path, query or header parameters are defined for this operation.

Request body

Required: Yes.

application/x-www-form-urlencoded

Field	Type	Required	Constraints / description
logout_token	string	Yes	minLength: 1; maxLength: 16384

{
  "type": "object",
  "required": [
    "logout_token"
  ],
  "properties": {
    "logout_token": {
      "type": "string",
      "minLength": 1,
      "maxLength": 16384
    }
  },
  "additionalProperties": false
}

Responses

204

Notice accepted, including a valid retry.

400

Request rejected or dependency unavailable. Responses are never shared-cacheable.

Content type: application/json Schema reference: Error.

Field	Type	Required	Constraints / description
error	string	Yes	—
message	string	Yes	—
requestId	string	No	—

{
  "$ref": "#/components/schemas/Error"
}

401

Request rejected or dependency unavailable. Responses are never shared-cacheable.

Content type: application/json Schema reference: Error.

Field	Type	Required	Constraints / description
error	string	Yes	—
message	string	Yes	—
requestId	string	No	—

{
  "$ref": "#/components/schemas/Error"
}

403

Request rejected or dependency unavailable. Responses are never shared-cacheable.

Content type: application/json Schema reference: Error.

Field	Type	Required	Constraints / description
error	string	Yes	—
message	string	Yes	—
requestId	string	No	—

{
  "$ref": "#/components/schemas/Error"
}

429

Request rejected or dependency unavailable. Responses are never shared-cacheable.

Content type: application/json Schema reference: Error.

Field	Type	Required	Constraints / description
error	string	Yes	—
message	string	Yes	—
requestId	string	No	—

{
  "$ref": "#/components/schemas/Error"
}

503

Request rejected or dependency unavailable. Responses are never shared-cacheable.

Content type: application/json Schema reference: Error.

Field	Type	Required	Constraints / description
error	string	Yes	—
message	string	Yes	—
requestId	string	No	—

{
  "$ref": "#/components/schemas/Error"
}

Related guidance

Request errors and safe retries · Troubleshooting