revoke_refresh_token
Revoke a refresh token to invalidate it. The API always reports success, so treat as requested, not confirmed; access tokens remain valid up to 15 minutes.
Instructions
Revoke a refresh token. SUCCESS HERE IS NOT EVIDENCE THAT ANYTHING HAPPENED.
`token` is the refresh token itself, not a client id and not an access token.
THE ENDPOINT ANSWERS SUCCESS WHETHER OR NOT THE TOKEN EXISTED. RFC 7009 §2.2
specifies that deliberately, so the endpoint cannot be used to discover whether a
token is valid. A typo, an already-revoked token and a real revocation are
indistinguishable in the response. Report that this was REQUESTED, never that it
was confirmed.
This is also the one call in this server that sends no credentials at all — the
token is the authorization. Do not paste one into a transcript on the way here.
Revoking a refresh token does not kill access tokens already issued from it;
those live until they expire, which for this API is fifteen minutes.
Requires the `admin` capability profile. No OAuth scope, because no token of ours
is sent.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | ||
| token_type_hint | No | refresh_token |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| note | Yes | ||
| requested | Yes |