Revoke an access or refresh token (RFC 7009)

POST

/oauth/revoke

curl --request POST \
  --url https://api.harperharbor.com/oauth/revoke \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data token=example

• Production

Form-encoded (or multipart) field token: an access token or a refresh token (detected by lookup). Revoking either revokes the whole session it belongs to (all access and refresh tokens of that grant); a legacy session-less access token is revoked individually. Returns 200 with an empty body whether or not the token was found.

Request Body^required

object

token

required

string

Example^generated

token=example

object

token

required

string

Responses

200

Revoked or not found (empty body).

400

invalid_request — missing token.

Media typeapplication/json

object

error

required

OAuth error code.

string

redirect_url

Only on the internal consent endpoints when the request expired.

string

retry_after

Seconds to wait before trying again; only with rate_limited.

integer

Example^generated

{
  "error": "example",
  "redirect_url": "example",
  "retry_after": 1
}

503

temporarily_unavailable.

Media typeapplication/json

object

error

required

OAuth error code.

string

redirect_url

Only on the internal consent endpoints when the request expired.

string

retry_after

Seconds to wait before trying again; only with rate_limited.

integer

Example^generated

{
  "error": "example",
  "redirect_url": "example",
  "retry_after": 1
}