---
title: "OAuth 2.0 Token Revocation (RFC 7009)"
method: POST
path: "/oauth/revoke"
tags: ["OAuth"]
---

# OAuth 2.0 Token Revocation (RFC 7009)

`POST /oauth/revoke`

## Request

- Base URL: `https://app.buildworkpro.com/api/v1`
- URL: `https://app.buildworkpro.com/api/v1/oauth/revoke`
- Auth: none required

Revokes an access token or refresh token. Body MUST be application/x-www-form-urlencoded. Per RFC 7009 §2.2, the response is 200 OK whether the token was successfully revoked, already revoked, expired, or unknown — this prevents leaking information about token validity. Revoking a refresh token cascades to the entire token family (all access + refresh tokens issued from the same grant). Revoking an access token does NOT cascade.

## Response `200`

Token revoked, already revoked, expired, or unknown — all return 200 per RFC 7009 §2.2

## Other responses

- `400`: RFC 7009 error envelope (invalid_request, invalid_client, invalid_grant)
- `401`: Client authentication failed (invalid_client)

---

[API](https://skmtc.dev/buildworkpro/apis/buildworkpro-api.md) · [All operations](https://skmtc.dev/buildworkpro/apis/buildworkpro-api/llms.txt) · [OpenAPI document](https://skmtc.dev/buildworkpro/apis/buildworkpro-api/revisions/441cf40012f7?raw)