---
title: "Revoke a credential (RFC 7009)"
method: POST
path: "/oauth2/revoke"
tags: ["agent-auth"]
---

# Revoke a credential (RFC 7009)

`POST /oauth2/revoke`

## Request

- Base URL: `https://www.supersetapp.com`
- URL: `https://www.supersetapp.com/oauth2/revoke`
- Auth: none required

Revokes an access token, a refresh token, or a claim token. A claim token is not one session: it takes the registration and every credential under it, and the person must run the ceremony again. A token that does not exist is still a 200 — the caller's goal is already met.

## Request body `application/x-www-form-urlencoded`

- object
  - `token` string, required: The token to revoke.

## Response `200`

The token is no longer valid.

## Other responses

- `400`: `invalid_request`: no `token` was sent.
- `429`: `slow_down`: too many revocations.

---

[API](https://skmtc.dev/supersetapp/apis/superset-api.md) - [All operations](https://skmtc.dev/supersetapp/apis/superset-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supersetapp/apis/superset-api/revisions/80be14a3d402?raw)