OAuth

Token revocation (RFC 7009)

Revokes a refresh token and every rotation in its family. Returns 200 whether or not the token existed, as RFC 7009 §2.2 requires: a different answer for an unknown token would make this endpoint an oracle for guessing them.

Access tokens are not revoked — they are self-contained and live at most one hour (fifteen minutes when they carry agent:approve).

post/oauth/revoke

Request

  • Base URL: https://api.execution.market
  • URL: https://api.execution.market/oauth/revoke
  • Auth: API key in header Signature-Input

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.