Revoke Staff View
POST/api/admin/portal/view-as-sessions/:session/revoke
Ends a staff view now. The viewer's next portal request is refused and the session is recorded as revoked. Revoking an already-ended view is a no-op.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Requires the portal.manage permission.
Session fields:
- id (integer): session id, used to revoke it.
- status (string): pending (link not yet opened), active, expired, exited (the viewer clicked Exit) or revoked.
- staff_user_id (integer), staff_name (string|null): who started the view.
- customer_id (integer): the portal account.
- buyer (object): id, name and email of the buyer viewed as.
- ip_address (string|null): IP the view was started from.
- created_at, started_at, expires_at, ended_at (string|null): ISO-8601 timestamps.
- end_reason (string|null): exited or revoked.
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.