call-identity-authentication-revoke-token-endpoint-3501e42.md

Call Identity Authentication Revoke Token Endpoint

The revoke token endpoint invalidates any access and refresh tokens issued to the client for the same end-user and session.

To revoke tokens from other sessions belonging to the same end-user, find the other session and revoke tokens for those sessions separately. For more information about finding user sessions, see Call Identity Authentication List Sessions Endpoint.

The token revocation endpoint is implemented according to RFC 7009 OAuth 2.0 Token Revocation.

Request

URI:https://<Cloud Identity Services domain>/oauth2/revoke

Note:

The domain part has the following pattern:

<tenant ID>.accounts.ondemand.com or <tenant ID>.accounts.cloud.sap. If you have a configured custom domain, the domain has the following pattern: <your custom domain>.

Tenant ID is an automatically generated ID by the system. The first administrator created for the tenant receives an activation email with a URL in it. This URL contains the tenant ID. For more information about your tenants, see View Assigned Tenants and Admins.

**HTTP Method:**POST

Request Headers

Header	Required	Values
Content-Type	Yes	application/x-www-form-urlencoded
Authentication	Yes	Basic Authentication - Client ID and a Secret to authenticate the client (relying party). For more information, see Configure Secrets for API Authentication. Note: The client ID and secret must be encoded using the "application/x-www-form-urlencoded" encoding algorithm. X.509 Certificate Bearer <client_credential_token>)

Request Parameters

Parameter	Required	Data Type	Description	Parameter Type
token	Yes	string	Must contain the JWT or opaque token from the issuer.	Path
token_type_hint	No	string		Path
client_id	No	string	Used to identify the corresponding Identity Authentication application. Note: The client_id parameter is mandatory if the request is provided without authentication.	Request body

Request Example

token=0ab12345978c51ffe7c4e9a2b1158bb4

Response

Token is successfully revoked.

Response Status and Error Codes

Code	Reason
200 OK	Successful operation.
401 Unauthorized	The client is not authenticated.