POST
Log out a partner customer device

Authorizations

X-API-Key
string
header
required

ISV / partner credential — public half. Required on every request.

Identifies the integration partner (ISV) making the call. Issued by Dime Trades when the ISV is onboarded and sent on every /partner/* endpoint:

  • On the two partner endpoints that create accounts or issue tokens (POST /partner/customers, POST /partner/customers/login), it is accompanied by X-API-Secret and is the only authentication — there is no user token yet.
  • On every other partner endpoint it is sent alongside the user's Authorization: Bearer <token>: the API key says which platform is calling, the bearer token says which user it is calling for.

Credentials are scoped to one or more brands; using a key with a brandId outside that scope returns 403. Staging and production keys are separate. The key identifies your platform — treat it as a backend credential.

X-API-Secret
string
header
required

ISV / partner credential — secret half. Sent on every /partner/* endpoint.

The confidential counterpart to X-API-Key. It is required, together with the key, on every /partner/* endpoint: register, login, refresh-token, logout, kyc, wallet-instructions and the replay endpoints. Outside /partner/* — the ordinary user API, called with a user's bearer token — the key is sent without the secret.

A request to a /partner/* endpoint that has a key without its matching secret is rejected with 401. The secret is shown once at issue time and stored only as a hash on our side — if it is lost or exposed, rotate the pair from the partner console rather than asking for a copy. Never ship it in a browser or mobile client: anyone holding it can mint a token for any of your users.

Body

application/json
deviceId
string
required

The device/session to log out. Recommended: a UUID.

Minimum string length: 1
Example:

"device-uuid-123"

externalCustomerId
string
required

The customer's identifier on your platform. Optional when the previous step returned a customer object; required on every subsequent partner call.

Required string length: 1 - 128
Example:

"ext-123"

Response

Device refresh session revoked.

data
object
errors
any[]