Withdraws the authorisation and terminates every session still open under it — each
token blacklisted, each row stamped, each termination signed into the tenant's audit
trail, and the tenant notified.

Always 204, never 404. Withdrawal is a row deletion, so

idempotency is structural rather than guarded: withdrawing when nothing is authorised
is a successful no-op. A 404 would report whether an authorisation exists, to a
caller who is entitled to ask but should not learn it from a status code they can
poll.

A session already past its own expiry closes as expired, not as revoked — that is what happened to it, and the tenant's remedy differs.