After a user successfully logs in to ABRA Flexi, an authentication session is created. After the company is selected, the system also stores context information about the connection to that company for each user, such as the base currency, company settings, or the user's permissions. Any change to this data affects only new logins, so a user who has been logged in for a long time would not know about it. The solution is to force the end of their session.
⚠️ Did you change an API user's permissions or role? Log the user out immediately afterward (see below). Otherwise, the change will take effect only after a long time, because the original settings remain in the API cache. This is the most common cause of permission problems for API users. After logging the user out, verify that the user behaves according to the new permissions.
Calling the service
POST https://demo.flexibee.eu/status/user/{přihlašovací jméno}/logout
⚠️ The same method is also used for the web interface. For API calls, therefore, request the format JSON or XML. This prevents the final redirect.
You can end the sessions of users logged in through the web interface, as well as API sessions created by JSON authentication. API requests that use HTTP authentication do not create any session.
Two ways to use the service
What you want to do | How to call it | Result |
Log the user out of all companies | Without any additional parameters. | All of the user's authentication sessions are terminated. |
Log the user out of a specific company | Add the parameter | Authentication sessions remain valid; only the context information is discarded. |
The context is refreshed and cached again automatically with the user's next request.
Examples
Logging out user novak from all companies and invalidating authentication:
POST https://demo.flexibee.eu/status/user/novak/logout
Logging out user franta from company nejlepsi_firma_a_s_ without invalidating authentication:
POST https://demo.flexibee.eu/status/user/franta/logout?company=nejlepsi_firma_a_s_
Response statuses
Status | When it occurs |
| Successful API call. The response body is empty. |
| Successful call from the web interface, with a redirect to |
| The user is not logged in; the body contains the message User '…' is not logged in. The same status occurs even if the context information was discarded but no authentication session existed, typically for API calls using HTTP authentication. |
💡 If you don't want the 404 error for a user who is not logged in, add the parameter ?ignore-not-found=true. The call will then return 200 even when there was nothing to log out, which is more practical for batch logouts.
POST https://demo.flexibee.eu/status/user/novak/logout?ignore-not-found=true
Who can use the service
A user with access to all companies who also has permission to manage the license.
Calls made under server authorization.
A user logging themselves out.