---
title: "OAuth 2.1 token revocation (RFC 7009)"
method: POST
path: "/oauth2/revoke"
tags: ["OAuth"]
---

# OAuth 2.1 token revocation (RFC 7009)

`POST /oauth2/revoke`

## Request

- Base URL: `https://api.uptimemonitoring.com`
- URL: `https://api.uptimemonitoring.com/oauth2/revoke`
- Auth: none required

Revokes an access or refresh token belonging to the authenticated
client. Always responds 200 for tokens owned by the caller, even
when the token is already gone (RFC 7009 §2.2 anti-probing). Token
type is advisory via `token_type_hint`; the server falls back to
JWT shape sniffing and tries the other type if the hint misses.

Client authentication is required (per RFC 7009): pass `client_id`
with optional `client_secret` via HTTP Basic, `client_secret_post`
form fields, or just `client_id` for public clients registered with
`token_endpoint_auth_method: "none"`. Tokens belonging to a
different client are silently ignored (still 200, anti-probing) but
not revoked.

## Response `200`

Revocation request acknowledged (also returned for tokens not owned by the caller, per anti-probing).

## Other responses

- `400`: Invalid request — missing token, malformed body.
- `401`: Client authentication failed — missing/wrong client credentials.
- `503`: Backend unavailable — the revocation may not have completed; the client should retry.

---

[API](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api.md) · [All operations](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/revisions/ddcb2a8bc70f?raw)