Revoke a token (RFC 7009)

POST

/v1/oauth/revoke

curl --request POST \
  --url https://dev-api.infiniteaudience.ai/v1/oauth/revoke \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data token=example \
  --data token_type_hint=access_token \
  --data client_id=example \
  --data client_secret=example

• Development API Server

Client-authenticated, same credentials as /v1/oauth/token. Call this when your user disconnects the integration. Always returns 200 with an empty body regardless of whether the presented token was valid, except when client authentication itself fails — there is nothing to distinguish for a caller who might be probing for valid tokens (RFC 7009 §2.2).

Request Body^required

object

token

required

string

token_type_hint

string

Allowed values: access_token refresh_token

client_id

string

client_secret

string

object

token

required

string

token_type_hint

string

Allowed values: access_token refresh_token

client_id

string

client_secret

string

Responses

200

Returned once the client itself authenticated, regardless of whether the presented token was valid.

Media typeapplication/json

object

Example^generated

{}

401

RFC 6749-shaped OAuth protocol error — error is a fixed machine-readable code and error_description is a human-readable detail. Deliberately NOT this API’s usual {error, code, message} shape — this is the RFC’s own error contract, used only by /v1/oauth/authorize, /v1/oauth/token, and /v1/oauth/revoke.

Media typeapplication/json

RFC 6749 §5.2 / §4.1.2.1 error body — see the OAuthError response component.

object

error

required

string

Allowed values: invalid_request invalid_client invalid_grant invalid_scope unsupported_response_type unsupported_grant_type access_denied server_error

error_description

required

string

Example

{
  "error": "invalid_request"
}