---
title: "Revoke a token (RFC 7009)."
method: POST
path: "/api/oauth/revoke"
tags: ["OAuth"]
---

# Revoke a token (RFC 7009).

`POST /api/oauth/revoke`

## Request

- Base URL: `https://app.tracepass.eu`
- URL: `https://app.tracepass.eu/api/oauth/revoke`
- Auth: none required

Revoke a refresh token. Always returns 200 even for an unknown
token (per RFC 7009, don't leak token validity). Confidential
clients authenticate with `client_secret`.

## Response `200`

Acknowledged (regardless of whether the token existed).

---

[API](https://skmtc.dev/tracepass/apis/tracepass-api.md) · [All operations](https://skmtc.dev/tracepass/apis/tracepass-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tracepass/apis/tracepass-api/revisions/60ddeb25638b?raw)