OAuth 2.0 token revocation (RFC 7009)

Changed on Sep 24, 2026

Revoke the session behind a token the client is discarding.

RFC 7009 is deliberate about the response: 200 for a successful revoke AND 200 for a token that is invalid, expired or not this client's. Anything else turns the endpoint into an oracle for probing which tokens exist. The one case that is NOT 200 here is a storage failure, because answering 200 there would tell the client the session is dead when it is still live.

post/t/{tenant}/oauth/revoke

Request

Base URL
https://api.leapsurgebi.com (the document declares no server; this is the origin it was published from)
Auth
none declared
TypeScript
https://skmtc.dev/leapsurgebi/apis/leapsurgeapi/docs/t/:tenant/oauth/revoke/post.ts
A function with typed inputs. Its response is checked against the schema.

Path parameters

tenantstring required

Headers

authorizationstring

Request body application/x-www-form-urlencoded

tokenstring

token_type_hintstring

client_idstring

client_secretstring

Response

Successful Response

unknown required

Changes

Sep 24, 202623b42df3193a Revision changes
- info
  endpoint added

Operation history