After a user successfully logs in to ABRA Flexi, an authentication session is created.
Subsequently, after a company is selected, the system creates context information for each user regarding the connection to that company. The context contains useful data that does not change very frequently — for example, the base currency, company settings, or user permissions. Any changes to this data will only take effect for new user logins.
If you need to ensure that changes are propagated to users who have been logged in for an extended period, the only option is to force their sessions to end. This can be done using the service at the following address:
POST /status/user/{přihlašovací jméno}/logoutNote: The same method is also used for the WUI, so when making API calls, request the format JSON or XML to prevent the final redirect.
Currently, this method can be used to terminate sessions of users logged in via the web interface, or API sessions created using JSON authentication. No session is created for API requests that use HTTP authentication.
The request can be sent using the POST method, and there are 2 possible use cases:
Log the user out of all companies and invalidate all authentication sessions
Log the user out of a specific company (all authentication sessions remain valid) — append the following parameter to the URL:
company=
Logging a user out of a company only discards the context information. The context will be automatically rebuilt and re-cached with the user's next request.
A successful call returns HTTP status 200 (API call), or a redirect (HTTP status 303) to the URL /status/user (HTML call).
If you do not want to receive an HTTP 404 error when logging out a user who is not currently logged in, append the optional parameter ?ignore-not-found=true. The error status is also returned if the context information was discarded but no authentication session existed (API call using HTTP authentication).
This service is available to users who have the right to access all companies and the right to manage the license. Alternatively, server authorization can be used, or a user may log themselves out.
Examples
Logging out user novak from all companies and invalidating the authentication:
POST /status/user/novak/logout
Logging out user franta from company nejlepsi_firma_a_s_ (without invalidating the authentication):
POST /status/user/franta/logout?company=nejlepsi_firma_a_s_