This endpoint allows an OAuth client to revoke its own access or refresh tokens.

• Must use HTTP Basic authentication with the OAuth client ID and secret.
• A token can only be revoked by the OAuth client to which it was issued.
• The request will succeed even if the token is already expired or invalid (as per RFC 7009).

Supported tokens

• Access tokens

Parameters

• token: Required. The token to revoke.

Behaviour

• Always returns 200 OK even if the token was not recognised or already expired.
• No response body is returned on success.

Endpoint Protection:

• HarborBasicTokenAuthGuard: Refer to guard documentation for details.

Examples:

• Revoke access token: Revokes an access token issued to the OAuth client.

{
  "token": "SlAV32hkKG",
  "token_type_hint": "access_token"
}

• Revoke refresh token: Revokes a refresh token and blocks further access token generation.

{
  "token": "8xLOxBtZp8",
  "token_type_hint": "refresh_token"
}