Revoke refresh tokens

curl --request POST \ --url https://{tenantDomain}/api/v2/refresh-tokens/revoke \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data ' { "ids": [ "<string>" ], "user_id": "<string>", "client_id": "<string>", "audience": "<string>" } '

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

Exactly one of the following combinations must be provided: ids (up to 100 token IDs); user_id; user_id + client_id; or user_id + client_id + audience. ids cannot be combined with user_id, client_id, or audience. audience requires both user_id and client_id. client_id alone is not allowed — it must be paired with user_id.

ids

string[]

Array of refresh token IDs to revoke. Limited to 100 at a time.

Minimum array length: 1

Required string length: 1 - 30

user_id

string<user-id>

Revoke all refresh tokens for this user.

Required string length: 1 - 300

client_id

string<client-id>

Revoke refresh tokens for this client. Must be paired with user_id; optionally narrowed further with audience.

Required string length: 1 - 64

audience

string

Resource server identifier (audience) to scope the revocation. Must be used with both user_id and client_id.

Required string length: 1 - 600

Response

Refresh token revocation request accepted.