---
title: "RFC 7009 token revocation"
method: POST
path: "/api/oauth2/revoke"
tags: ["OAuth"]
---

# RFC 7009 token revocation

`POST /api/oauth2/revoke`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/oauth2/revoke`
- Auth: none required

Always answers 200, even for an unknown, mismatched, or already-revoked token -- spec-mandated non-oracle behavior. Presenting a refresh token revokes its whole family.

## Request body

- object
  - `token` string, required
  - `client_id` string

## Response `200`

Always OK, empty body.

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)