---
title: "Revoke an access or refresh token"
method: POST
path: "/oauth/revoke"
tags: ["Authentication"]
---

# Revoke an access or refresh token

`POST /oauth/revoke`

## Request

- Base URL: `https://riskmodels.app/api`
- URL: `https://riskmodels.app/api/oauth/revoke`
- Auth: none required

RFC 7009 token revocation. Revokes the presented `rm_user_*` access token or refresh token. Rate limited to 60 requests per IP per minute. Per RFC 7009 the endpoint returns 200 even for unknown tokens.

## Request body

- OAuth2RevokeRequest
  - `token` string, required: The `rm_user_*` access token or the opaque refresh token to revoke. The endpoint infers which from the `rm_user_` prefix.

## Response `200`

Token revoked (or was already invalid). Body is an empty object.

## Other responses

- `400`: invalid_request — `token` parameter missing
- `429`: Revocation rate limit exceeded

---

[API](https://skmtc.dev/riskmodels/apis/riskmodels-api.md) · [All operations](https://skmtc.dev/riskmodels/apis/riskmodels-api/llms.txt) · [OpenAPI document](https://skmtc.dev/riskmodels/apis/riskmodels-api/revisions/1a034cad408a?raw)