curl --request POST \
--url https://api-uat.dimetrades.com/api/partner/customers/logout \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--header 'X-API-Secret: <api-key>' \
--data '
{
"deviceId": "device-uuid-123",
"externalCustomerId": "ext-123"
}
'import requests
url = "https://api-uat.dimetrades.com/api/partner/customers/logout"
payload = {
"deviceId": "device-uuid-123",
"externalCustomerId": "ext-123"
}
headers = {
"X-API-Key": "<api-key>",
"X-API-Secret": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-API-Key': '<api-key>',
'X-API-Secret': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({deviceId: 'device-uuid-123', externalCustomerId: 'ext-123'})
};
fetch('https://api-uat.dimetrades.com/api/partner/customers/logout', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-uat.dimetrades.com/api/partner/customers/logout",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'deviceId' => 'device-uuid-123',
'externalCustomerId' => 'ext-123'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>",
"X-API-Secret: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-uat.dimetrades.com/api/partner/customers/logout"
payload := strings.NewReader("{\n \"deviceId\": \"device-uuid-123\",\n \"externalCustomerId\": \"ext-123\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("X-API-Secret", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-uat.dimetrades.com/api/partner/customers/logout")
.header("X-API-Key", "<api-key>")
.header("X-API-Secret", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"deviceId\": \"device-uuid-123\",\n \"externalCustomerId\": \"ext-123\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-uat.dimetrades.com/api/partner/customers/logout")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["X-API-Secret"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"deviceId\": \"device-uuid-123\",\n \"externalCustomerId\": \"ext-123\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"message": "Logged out successfully"
},
"errors": []
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 401,
"error": "BrandUnauthorized",
"message": "Invalid brand credentials",
"code": 17001,
"explanation": "The X-API-Key / X-API-Secret pair is missing or does not match an active credential."
}
}{
"data": {},
"errors": {
"statusCode": 403,
"error": "BrandInactive",
"message": "Brand is suspended",
"code": 17002,
"explanation": "This brand has been suspended and can no longer make partner API calls."
}
}{
"data": {},
"errors": {
"statusCode": 404,
"error": "DeviceSessionNotFound",
"message": "Device session not found",
"code": 17004,
"explanation": "No active refresh session exists for this device. The session may already have been revoked or expired."
}
}{
"data": {},
"errors": {
"statusCode": 500,
"error": "InternalError",
"message": "Internal Server Error",
"code": 1003,
"explanation": "An unexpected error occurred on the server, Please try again later."
}
}Log out a partner customer device
Invalidates the refresh session for a specific device. The ISV sends only the deviceId (body) and externalCustomerId (body); no refresh token is presented. The backend resolves the user, then revokes the Redis slot for that (userId, deviceId) — only that device’s session, leaving the customer’s other devices intact.
Server-to-server only. All /partner/* endpoints are authenticated with your brand credentials — X-API-Key + X-API-Secret headers — not with an end-user bearer token. Never expose these credentials to a browser or mobile app.
Session / device limits
Each session is bound to a deviceId. A user can hold at most max_user_sessions (5) active device sessions; creating a new one at that limit fails with MAX_USER_SESSIONS_REACHED (403). Use the refresh-token and logout endpoints to manage existing sessions.
curl --request POST \
--url https://api-uat.dimetrades.com/api/partner/customers/logout \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--header 'X-API-Secret: <api-key>' \
--data '
{
"deviceId": "device-uuid-123",
"externalCustomerId": "ext-123"
}
'import requests
url = "https://api-uat.dimetrades.com/api/partner/customers/logout"
payload = {
"deviceId": "device-uuid-123",
"externalCustomerId": "ext-123"
}
headers = {
"X-API-Key": "<api-key>",
"X-API-Secret": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-API-Key': '<api-key>',
'X-API-Secret': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({deviceId: 'device-uuid-123', externalCustomerId: 'ext-123'})
};
fetch('https://api-uat.dimetrades.com/api/partner/customers/logout', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-uat.dimetrades.com/api/partner/customers/logout",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'deviceId' => 'device-uuid-123',
'externalCustomerId' => 'ext-123'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>",
"X-API-Secret: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-uat.dimetrades.com/api/partner/customers/logout"
payload := strings.NewReader("{\n \"deviceId\": \"device-uuid-123\",\n \"externalCustomerId\": \"ext-123\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("X-API-Secret", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-uat.dimetrades.com/api/partner/customers/logout")
.header("X-API-Key", "<api-key>")
.header("X-API-Secret", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"deviceId\": \"device-uuid-123\",\n \"externalCustomerId\": \"ext-123\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-uat.dimetrades.com/api/partner/customers/logout")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["X-API-Secret"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"deviceId\": \"device-uuid-123\",\n \"externalCustomerId\": \"ext-123\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"message": "Logged out successfully"
},
"errors": []
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 401,
"error": "BrandUnauthorized",
"message": "Invalid brand credentials",
"code": 17001,
"explanation": "The X-API-Key / X-API-Secret pair is missing or does not match an active credential."
}
}{
"data": {},
"errors": {
"statusCode": 403,
"error": "BrandInactive",
"message": "Brand is suspended",
"code": 17002,
"explanation": "This brand has been suspended and can no longer make partner API calls."
}
}{
"data": {},
"errors": {
"statusCode": 404,
"error": "DeviceSessionNotFound",
"message": "Device session not found",
"code": 17004,
"explanation": "No active refresh session exists for this device. The session may already have been revoked or expired."
}
}{
"data": {},
"errors": {
"statusCode": 500,
"error": "InternalError",
"message": "Internal Server Error",
"code": 1003,
"explanation": "An unexpected error occurred on the server, Please try again later."
}
}Authorizations
ISV / partner credential — public half. Required on every request.
Identifies the integration partner (ISV) making the call. Issued by Dime
Trades when the ISV is onboarded and sent on every /partner/* endpoint:
X-API-Key: dt_pk_live_7f3c9a2e5b18
- On the two partner endpoints that create accounts or issue tokens (
POST /partner/customers,POST /partner/customers/login), it is accompanied byX-API-Secretand is the only authentication — there is no user token yet. - On every other partner endpoint it is sent alongside the user's
Authorization: Bearer <token>: the API key says which platform is calling, the bearer token says which user it is calling for.
Credentials are scoped to one or more brands; using a key with a brandId outside that scope returns 403. Staging and production keys are separate.
The key identifies your platform — treat it as a backend credential.
ISV / partner credential — secret half. Sent on every /partner/* endpoint.
The confidential counterpart to X-API-Key. It is required, together with the key, on every /partner/* endpoint: register, login, refresh-token, logout, kyc, wallet-instructions and the replay endpoints. Outside /partner/* — the ordinary user API, called with a user's bearer token — the key is sent without the secret.
X-API-Key: dt_pk_live_7f3c9a2e5b18
X-API-Secret: dt_sk_live_9d41ba07c6e2f85a3b7c1049de26f8b1
A request to a /partner/* endpoint that has a key without its matching secret is rejected with 401. The secret is shown once at issue time and stored only as a hash on our side — if it is lost or exposed, rotate the pair from the partner console rather than asking for a copy. Never ship it in a browser or mobile client: anyone holding it can mint a token for any of your users.
Body
The device/session to log out. Recommended: a UUID.
1"device-uuid-123"
The customer's identifier on your platform. Optional when the previous step returned a customer object; required on every subsequent partner call.
1 - 128"ext-123"
