---
title: "Revoke OAuth token"
method: POST
path: "/oauth_token/remove/{oauth_token_id}"
tags: ["OAuth Tokens"]
---

# Revoke OAuth token

`POST /oauth_token/remove/{oauth_token_id}`

## Request

- Base URL: `https://api.treasuredata.com/v3`
- URL: `https://api.treasuredata.com/v3/oauth_token/remove/{oauth_token_id}`
- Auth: HTTP td1
- TypeScript: <https://skmtc.dev/treasure/apis/treasure-data-api/docs/oauth_token/remove/:oauth_token_id/post.ts> (a function with typed inputs; its response is checked against the schema)

Revokes the token named, every other live token the same user holds for the same OAuth client, and every authorization code that user was issued for the client and has not yet exchanged. Both halves of a credential live on one row, so each refresh token is closed with its access token. All of them stop working immediately, and the client must be authorized again to get a new token.

The wide reach is deliberate. An administrator revokes to contain a leaked credential, and a refresh leaves the row it replaced usable until the new token is first used -- after which the database no longer records which rows came before it. Closing the user's whole authorization is what leaves no part of it usable. Unexchanged codes go too, because whoever holds one can trade it for a new token pair without the user taking part.

One call does not settle the matter: a refresh already in flight can add a live token just after the revocation reads the rows. Re-list, and revoke again if anything remains.

If the token belongs to a sub user, revoking it deactivates that sub user too, along with its API keys. A sub user exists for one authorization, so closing the authorization ends the principal: nothing is left to run its scheduled work.

Administrators only, authenticated by an apikey or a session; an OAuth bearer token is refused. Requires the `eng-lc-oauth-token-management` launch control flag on the account.

Answers 404 whether the id is malformed, names no token, names a token in another account, or names one that is already revoked.

A client closing a credential it holds itself uses `POST /oauth/revoke` (RFC 7009), which revokes that credential and the rows a refresh still links to it, and leaves the user's other tokens for the client alone. It deactivates a sub user owner just as this does.

## Path parameters

- `oauth_token_id` Id, required (unresolved $ref)

## Response `200`

OK. Only the token named in the path is returned; the other tokens and the authorization codes revoked alongside it are not listed. Re-list to see what remains.

- object
  - `oauth_token` OauthToken, required: An OAuth credential issued to a client on behalf of a user. The token and refresh token strings are secrets and are never included.
    - `id` integer, required: unique identifier of the token
    - `client` union, required: the OAuth client the token was issued to. `null` for a token issued without a client
      - object, nullable
      - OauthTokenClient: Minimal information on the OAuth client a token was issued to
        - `id` integer, required: unique identifier of the client
        - `name` string, required: the name of the client
    - `created_at` string, date-time, required: when the token was issued
    - `expired` boolean, required: whether the access half has expired. An expired token is still listed, because a `refreshable` one can be exchanged for a new access token until the row is revoked -- a refresh token never expires
    - `expires_at` string, date-time, nullable, required: when the access half expires. `null` for a token that never expires
    - `refreshable` boolean, required: whether the token carries a refresh token
    - `scopes` string, required: the scopes granted to the token, space separated
    - `sub_user` boolean, required: whether the owner is a sub user
    - `user` union, required: the user the token was issued on behalf of. `null` when the user no longer resolves
      - object, nullable
      - OauthTokenUserReference: Minimal information on the user an OAuth token belongs to
        - `id` integer, required: unique identifier of the user
        - `email` string, required: the email of the user
        - `name` string, required: the display name of the user

## Changes

- **2026-09-08** `e5f660d781e9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/treasure/apis/treasure-data-api/changes/oauth_token/remove/:oauth_token_id/post.md)

---

[API](https://skmtc.dev/treasure/apis/treasure-data-api.md) - [All operations](https://skmtc.dev/treasure/apis/treasure-data-api/llms.txt) - [OpenAPI document](https://skmtc.dev/treasure/apis/treasure-data-api/revisions/961bbd0161ae?raw)