---
title: "Revoke Endpoint"
method: POST
path: "/oauth/focused/revoke"
tags: ["oauth-provider", "oauth-provider"]
---

# Revoke Endpoint

`POST /oauth/focused/revoke`

OAuth 2.1 token revocation endpoint (RFC 7009).

Revokes access tokens or refresh tokens.
Always returns 200 (even if token doesn't exist).

Request Body:
    token: Access token (JWT) or refresh token (opaque)
    client_id: OAuth client ID

Returns:
    200 OK (always, per RFC 7009)

Security Notes:
    - Always returns 200 to avoid leaking token existence
    - Rate limited per client
    - Validates client_id matches token owner
    - Supports both access tokens (JWT) and refresh tokens (opaque)

Example Request:
    {
        "token": "eyJhbGc...",
        "client_id": "client_abc123"
    }

Example Response:
    {
        "success": true
    }

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/priority-guard/apis/priority-guardian.md) · [All operations](https://skmtc.net/priority-guard/apis/priority-guardian/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/priority-guard/priority-guardian/revisions/8579218b716d/schema)