Token Revocation Endpoint
POST/openapi/v1/oauth/revoke
Revokes an access token or refresh token.
Per RFC 7009 §2.2, this endpoint always returns `200 OK` — including when the token is already expired or unknown.
Access token revocation: The token is immediately invalidated.
Refresh token revocation: The refresh token and all access tokens derived from it are immediately invalidated. Subsequent API calls using those access tokens will return 401 invalid_token.
Request Parameters
Request Body
application/x-www-form-urlencodedtokenRequiredstring
The access token or refresh token to revoke. Revoking a refresh token also immediately invalidates all access tokens derived from it.
token_type_hintOptionalstring
Optional hint to optimize revocation. Does not affect the result.
access_tokenrefresh_token
client_idOptionalstring
Required for all recognized tokens. Must match the token's owner.
client_secretOptionalstring(password)
Required for confidential clients (in addition to `client_id`).
Request Example
"token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...&token_type_hint=access_token&client_id=SGCLxQk2mN8pR4vW1yH3jT5bZ6aE7cF0&client_secret=Kj3mN8pR4vW1xZ6bY2qT5hE9gA0cF7dLsUr4Qz8P"Response Parameters
Error Codes
| HTTP Status | Error Code | Description |
|---|---|---|
| 400 | invalid_request | `token` parameter is missing. |
| 401 | invalid_client | client_secret not provided for confidential client |
| 401 | invalid_client | Client authentication failed |