# Clear user

Clears the user context for all subsequent events.

Endpoint: POST /action/clear-user
Security: risk_access_token

## Security:

  - `risk_access_token` (unknown)
    http bearer JWT

## Request fields (application/json):

  - `session_token` (string, required)
    A token returned by the SDK for the device session established upon SDK initialization.

  - `secured_session_token` (string, required)
    A cryptographically signed token returned by the SDK's `getSecureSessionToken()` method. Provides enhanced security through device binding and anti-replay protection.

## Response 201:

  - `201` (unknown)
    The user association has been cleared for the device.

## Response 201 fields (application/json):

  - `success` (boolean)
    Defines if the operation was successful.
    Example: true

  - `message` (string)
    A human-readable confirmation message.
    Example: User has been cleared.

## Response 400:

  - `400` (unknown)
    Bad request

## Response 401:

  - `401` (unknown)
    Invalid authentication

## Response 403:

  - `403` (unknown)
    Invalid authorization

## Response 429:

  - `429` (unknown)
    Rate limit reached

## Response 463:

  - `463` (unknown)
    Blacklisted token—Returned when Fraud Prevention detects repeated or abusive token/payload misuse within a short time window (e.g., reuse of expired tokens, token caching/automation, or repeated invalid requests, including highly repetitive invalid request values). The response body contains the underlying error code (e.g., expired session token). Clients should identify and stop the source of invalid requests. Other authorization failures that do not trigger blacklisting return 403 Forbidden.

## Response 500:

  - `500` (unknown)
    Internal error