A result of 504 Gateway Timeout, 202 Accepted, or 200 OK on POST /admin/v1/users/dax.mercer/revoke-sessions is not proof. Closed-loop checks read GET /users/dax.mercer/sessions and /factors, and then look for a 401 Unauthorized on the next replay.