OAuth

Owner-initiated revocation of an OAuth grant by id

Revokes a grant the caller owns, by its opaque grant_id, within an org the caller owns/admins. Distinct from RFC 7009 POST /oauth/revoke (which lets a token HOLDER revoke its OWN token). Idempotent: revoking an already-revoked grant in the caller's org returns revoked:true with already_revoked:true. The revocation cascades to the grant's refresh token (a single grant row holds both the access and refresh token hashes), and is recorded on the org's audit trail (action=oauth.grant_revoked). A grant in another org — or unknown — returns 404 with no distinction (no cross-org existence oracle).

post/oauth/grants/revoke

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/oauth/grants/revoke
  • Auth: one of:
    • HTTP bearer
    • API key in header X-Mnemom-Api-Key
    • API key in cookie mnemom_session

Request body

grant_idstring required
org_idstring required

Response

The grant is revoked (idempotent).

revokedtrue
grant_idstring
already_revokedboolean

true when the grant was already revoked before this call.

Changes

No recorded changes to this operation across all 2 revisions of this API.