---
title: "Process Revocation Request"
method: POST
path: "/api/{serviceId}/auth/revocation"
tags: ["Revocation Endpoint"]
---

# Process Revocation Request

`POST /api/{serviceId}/auth/revocation`

This API revokes access tokens and refresh tokens.

## Path parameters

- `serviceId` string, required

## Request body

- RevocationRequest
  - `parameters` string, required — OAuth 2.0 token revocation request parameters which are the request parameters that the OAuth 2.0 token revocation endpoint ([RFC 7009](https://datatracker.ietf.org/doc/html/rfc7009)) of the authorization server implementation received from the client application. The value of parameters is the entire entity body (which is formatted in `application/x-www-form-urlencoded`) of the request from the client application.
  - `clientId` string — The client ID extracted from `Authorization` header of the revocation request from the client application. If the revocation endpoint of the authorization server implementation supports Basic Authentication as a means of client authentication, and the request from the client application contains its client ID in `Authorization` header, the value should be extracted and set to this parameter.
  - `clientSecret` string — The client secret extracted from `Authorization` header of the revocation request from the client application. If the revocation endpoint of the authorization server implementation supports basic authentication as a means of client authentication, and the request from the client application contained its client secret in `Authorization` header, the value should be extracted and set to this parameter.
  - `clientCertificate` string — The client certificate used in the TLS connection between the client application and the revocation endpoint.
  - `clientCertificatePath` string[] — The certificate path presented by the client during client authentication.
  - `oauthClientAttestation` string — The value of the `OAuth-Client-Attestation` HTTP header, which is defined in the specification of [OAuth 2.0 Attestation-Based Client Authentication](https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/).
  - `oauthClientAttestationPop` string — The value of the `OAuth-Client-Attestation-PoP` HTTP header, which is defined in the specification of [OAuth 2.0 Attestation-Based Client Authentication](https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/).

## Response `200`

Token revoked successfully

- RevocationResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'INTERNAL_SERVER_ERROR' | 'INVALID_CLIENT' | 'BAD_REQUEST' | 'OK' — The next action that the authorization server implementation should take.
  - `responseContent` string — The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of `action` parameter.

## Other responses

- `400`
- `401`
- `403`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

## Changes

- **2026-08-03** `7ad74ab64749` — 1 info
  - added the non-success response with the status `429`

[Change history](https://skmtc.dev/authlete/apis/authlete-api/changes/api/:serviceId/auth/revocation/post.md)

---

[API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/7ad74ab64749/schema)