---
title: "Revoke access token (v1 no-op)"
method: POST
path: "/oauth/revoke"
tags: ["Authentication"]
---

# Revoke access token (v1 no-op)

`POST /oauth/revoke`

## Request

- Base URL: `https://auth.pirros.com`
- URL: `https://auth.pirros.com/oauth/revoke`
- Auth: none declared

No-op in v1. This endpoint authenticates the client and always returns 200 per RFC 7009 idempotence, but revokes nothing — it does not invalidate any issued token. Actual credential revocation — which instantly invalidates the tokens a credential has issued — is performed by a firm administrator through the Pirros credential-management UI. Served by the Pirros auth host (not the external API host).

## Request body

- RevokeRequest: OAuth 2.0 token revocation request
  - `token` string
  - `client_id` string, uuid, required
  - `client_secret` string, required

## Response `200`

Acknowledged (client authenticated; nothing revoked)

- RevokeSuccess: Token revocation acknowledgement (RFC 7009 idempotence)
  - `request_id` string, uuid, required

## Other responses

- `400`: Invalid request
- `401`: Invalid client credentials

---

[API](https://skmtc.dev/pirros/apis/pirros-external-api.md) - [All operations](https://skmtc.dev/pirros/apis/pirros-external-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pirros/apis/pirros-external-api/revisions/01c66b8d9fd1?raw)