Skip to content

Revoke token

Request

OAuth2 token revocation endpoint (RFC 7009). Revokes an access or refresh token issued to the authenticated client. Access and refresh tokens issued together are revoked together.

Authenticate with HTTP Basic or with client_id and client_secret in the request body, the same as the token endpoint.

token_type_hint is an optional lookup optimization; both token types are searched regardless. Per RFC 7009 Section 2.2 the endpoint returns 200 even when the token is unknown or already revoked. It cannot be used to probe for valid tokens.

Bodyapplication/x-www-form-urlencodedrequired
tokenstringrequired
The access or refresh token to revoke.
token_type_hintstring
Optional hint about the token type.
Enum:"access_token""refresh_token"
client_idstring
Client identifier. Omit when authenticating with HTTP Basic.
client_secretstring
Client secret. Omit when authenticating with HTTP Basic.
curl -i -X POST \
  https://rp-intranet.lab1.blueharvest.cloud/_mock/openapi/oauth2/revoke \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode token=YOUR_ACCESS_TOKEN \
  --data-urlencode token_type_hint=access_token \
  --data-urlencode client_id=client_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d \
  --data-urlencode client_secret=YOUR_CLIENT_SECRET

Responses

The token has been revoked or was already invalid.
Response
No content