Admin
Sign someone out everywhere
DELETE
Bearerheader
AuthorizationBearer <JWT>uid*stringLength
1 <= lengthSigned out
application/json- response
success*trueValue in
truedata*Example Request
curl -X DELETE 'http://localhost:3000/admin/users/string/sessions'Example Response
{ "success": true, "data": { "ok": true }}Disable or restore an account PATCH
Disabling ends every session at once, in every app — a disabled person with a live token is not disabled.
Show a dependent's full phone or document POST
The one way past the mask (P5, BO-12). Owner or admin only, with a reason, rate-limited per operator (RATE_ADMIN_REVEAL_PER_OPERATOR, default 20 per hour). Every attempt is written to the audit trail as `dependent.reveal` — the field and the reason, NEVER the value — and so is every refusal (a viewer, the limit). The value comes back once, with `Cache-Control: no-store`; ask again to see it again.