---
title: "OAuth token revocation (RFC 7009)"
method: POST
path: "/oauth/revoke"
tags: ["OAuth"]
---

# OAuth token revocation (RFC 7009)

`POST /oauth/revoke`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/oauth/revoke`
- Auth: none required

Revokes an access or refresh token for the authenticated client. Unknown tokens are not an error (200 after successful client authentication). Answers 404 while `OAUTH_ENABLED` is off. No Tre bearer.

## Response `200`

Revoked, or token was already unknown

- OAuthRevokeResponse: Always empty: RFC 7009 carries the outcome in the status code alone.

## Other responses

- `400`: OAuth error: `invalid_request` (a form field that fails validation is named as `<field> is missing` or `<field> is invalid`), `invalid_grant`, `unsupported_grant_type`, or — on the token endpoint — `invalid_target`.
- `401`: invalid_client
- `404`: OAuth door is off (`OAUTH_ENABLED` unset or not `true`).
- `429`: Rate limited: `invalid_request`, and `Retry-After` names the wait.
- `500`: server_error
- `503`: server_error (dependency), with `Retry-After`.

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)