# Revoke token

OAuth2 token revocation endpoint (RFC 7009). Revokes an access or refresh
token issued to the authenticated client. Access and refresh tokens issued
together are revoked together.
Authenticate with HTTP Basic or with `client_id` and `client_secret` in the
request body, the same as the token endpoint.
`token_type_hint` is an optional lookup optimization; both token types are searched regardless.
Per RFC 7009 Section 2.2 the endpoint returns `200` even when the token is unknown or already revoked.
It cannot be used to probe for valid tokens.

Endpoint: POST /oauth2/revoke
Version: 1.1.0

## Request fields (application/x-www-form-urlencoded):

  - `token` (string, required)
    The access or refresh token to revoke.

  - `token_type_hint` (string)
    Optional hint about the token type.
    Enum: "access_token", "refresh_token"

  - `client_id` (string)
    Client identifier. Omit when authenticating with HTTP Basic.

  - `client_secret` (string)
    Client secret. Omit when authenticating with HTTP Basic.

## Request examples:

  - `RevokeAccessToken` (unknown)

## Response 200:

  - `200` (unknown)
    The token has been revoked or was already invalid.

## Response 400:

  - `400` (unknown)
    OAuth2 error (RFC 6749 Section 5.2 / RFC 7591 Section 3.2.2).
The `error` field carries the standard OAuth2 error code.

## Response 400 fields (application/json):

  - `error` (string, required)
    Machine-readable error code.
    Enum: "invalid_request", "invalid_client", "invalid_grant", "unauthorized_client", "unsupported_grant_type", "unsupported_response_type", "invalid_scope", "invalid_client_metadata", "invalid_redirect_uri", "invalid_token", "access_denied", "server_error"

  - `error_description` (string)
    Human-readable explanation of the error.

## Response 401:

  - `401` (unknown)
    Client authentication failed (`error: invalid_client`, RFC 6749 Section 5.2) or the presented bearer token is invalid (`error: invalid_token`, RFC 6750).
The response carries a `WWW-Authenticate` challenge naming the expected authentication scheme.

## Response 401 fields (application/json):

  - `error` (string, required)
    Machine-readable error code.
    Enum: "invalid_request", "invalid_client", "invalid_grant", "unauthorized_client", "unsupported_grant_type", "unsupported_response_type", "invalid_scope", "invalid_client_metadata", "invalid_redirect_uri", "invalid_token", "access_denied", "server_error"

  - `error_description` (string)
    Human-readable explanation of the error.

## Response 401 headers (application/json):

  - `WWW-Authenticate` (string)
    Authentication challenge, for example: `Basic realm="redocly-cafe"` or `Bearer realm="redocly-cafe", error="invalid_token"`.

## Response 500:

  - `500` (unknown)
    Unexpected server error, reported with the `server_error` error code.

## Response 500 fields (application/json):

  - `error` (string, required)
    Machine-readable error code.
    Enum: "invalid_request", "invalid_client", "invalid_grant", "unauthorized_client", "unsupported_grant_type", "unsupported_response_type", "invalid_scope", "invalid_client_metadata", "invalid_redirect_uri", "invalid_token", "access_denied", "server_error"

  - `error_description` (string)
    Human-readable explanation of the error.

## Response 400 examples:

  - `Refresh token is invalid or expired` (unknown)

  - `Requested scope does not exist` (unknown)

## Response 401 examples:

  - `Wrong client_id or client_secret` (unknown)

  - `Wrong registration access token` (unknown)

## Response 500 examples:

  - `Unexpected server error` (unknown)