AUauthlete
Revocation Endpoint

Process Revocation Request

Changed on

This API revokes access tokens and refresh tokens.

post/api/{serviceId}/auth/revocation

Request

  • Base URL
    https://us.authlete.com
  • URL
    https://us.authlete.com/api/{serviceId}/auth/revocation
  • Auth
    HTTP bearer

Path parameters

serviceIdstring required

A service ID.

Request body

parametersstring required

OAuth 2.0 token revocation request parameters which are the request parameters that the OAuth 2.0 token revocation endpoint (RFC 7009) of the authorization server implementation received from the client application.

The value of parameters is the entire entity body (which is formatted in application/x-www-form-urlencoded) of the request from the client application.

clientIdstring

The client ID extracted from Authorization header of the revocation request from the client application.

If the revocation endpoint of the authorization server implementation supports Basic Authentication as a means of client authentication, and the request from the client application contains its client ID in Authorization header, the value should be extracted and set to this parameter.

clientSecretstring

The client secret extracted from Authorization header of the revocation request from the client application.

If the revocation endpoint of the authorization server implementation supports basic authentication as a means of client authentication, and the request from the client application contained its client secret in Authorization header, the value should be extracted and set to this parameter.

clientCertificatestring

The client certificate used in the TLS connection between the client application and the revocation endpoint.

clientCertificatePathstring[]

The certificate path presented by the client during client authentication.

oauthClientAttestationstring

The value of the OAuth-Client-Attestation HTTP header, which is defined in the specification of OAuth 2.0 Attestation-Based Client Authentication.

oauthClientAttestationPopstring

The value of the OAuth-Client-Attestation-PoP HTTP header, which is defined in the specification of OAuth 2.0 Attestation-Based Client Authentication.

Response

Token revoked successfully

resultCodestring

The code which represents the result of the API call.

resultMessagestring

A short message which explains the result of the API call.

action'INTERNAL_SERVER_ERROR' | 'INVALID_CLIENT' | 'BAD_REQUEST' | 'OK'

The next action that the authorization server implementation should take.

responseContentstring

The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of action parameter.

Changes