---
title: "OAuth 2.0 token revocation (RFC 7009)"
method: POST
path: "/t/{tenant}/oauth/revoke"
tags: ["MCP Entra OAuth"]
---

# OAuth 2.0 token revocation (RFC 7009)

`POST /t/{tenant}/oauth/revoke`

## Request

- Base URL: `https://api.leapsurgebi.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.leapsurgebi.com/t/{tenant}/oauth/revoke`
- Auth: none declared
- TypeScript: <https://skmtc.dev/leapsurgebi/apis/leapsurgeapi/docs/t/:tenant/oauth/revoke/post.ts> (a function with typed inputs; its response is checked against the schema)

Revoke the session behind a token the client is discarding.

RFC 7009 is deliberate about the response: 200 for a successful revoke AND
200 for a token that is invalid, expired or not this client's. Anything else
turns the endpoint into an oracle for probing which tokens exist. The one
case that is NOT 200 here is a storage failure, because answering 200 there
would tell the client the session is dead when it is still live.

## Path parameters

- `tenant` string, required

## Headers

- `authorization` string

## Request body `application/x-www-form-urlencoded`

- BodyRevokeTTenantOauthRevokePost
  - `token` string
  - `token_type_hint` string
  - `client_id` string
  - `client_secret` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

## Changes

- **2026-09-24** `23b42df3193a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/leapsurgebi/apis/leapsurgeapi/changes/t/:tenant/oauth/revoke/post.md)

---

[API](https://skmtc.dev/leapsurgebi/apis/leapsurgeapi.md) - [All operations](https://skmtc.dev/leapsurgebi/apis/leapsurgeapi/llms.txt) - [OpenAPI document](https://skmtc.dev/leapsurgebi/apis/leapsurgeapi/revisions/13653cb8ee76?raw)