Revoke a refresh token or a user access token (RFC 7009)
POST/oauth/revoke
Client-authenticated. Ends the consent the token was issued under, so every access token issued under it stops on its next use and every refresh token in the family dies. Always 200 for an unknown or foreign token.
Request
Responses
- 200
- 400
- 401
- 405
- 503
Revoked, or nothing to revoke. Empty body.
invalid_request: token missing.
invalid_client: client authentication failed.
Fail-closed RFC 9457 Problem Details. No stack traces or credentials.
Response Headers
X-Request-ID
Server-generated opaque request correlation ID.
X-AfricaOne-API-Version
Cache-Control
Revocation is not integrated, or the platform is switched off.
Response Headers
X-Request-ID
Server-generated opaque request correlation ID.
X-AfricaOne-API-Version
Cache-Control