Logout (Single Device)

POST /v1/users/auth/logout

Auth: None (the refresh token itself is the credential)

Field	Type	Required	Description
refreshToken	string	Yes	The refresh token for the session being logged out

curl -X POST https://api.2settle.io/v1/users/auth/logout \
  -H "Content-Type: application/json" \
  -d '{ "refreshToken": "6f2c9a8e..." }'

{ "success": true }

Notes:

• Revokes just that one refresh token — other devices/sessions for the same user stay logged in.
• The access token isn't invalidated by this call — it simply expires on its own shortly after; the client should just drop both tokens locally and stop calling /refresh.