---
title: "Revoke a grant"
method: POST
path: "/oauth/revoke"
tags: ["OAuth"]
---

# Revoke a grant

`POST /oauth/revoke`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/oauth/revoke`
- Auth: HTTP bearer

RFC 7009. Always `200`, even for a token that was never issued — a client cleaning up after
itself must not be able to use this endpoint to discover whether a token string is real. The
secret half must still match the stored digest, or knowing a prefix would be enough to
disconnect somebody else's assistant.

Revoking either half of a pair takes the whole grant down. A client asking to be disconnected
means it.

## Request body

- object
  - `token` string
  - `token_type_hint` string

## Response `200`

Acknowledged.

- object
  - `revoked` boolean

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)