Token revocation endpoint
The token revocation endpoint allows clients to notify the authorization server that a previously obtained refresh or access token is no longer needed. The revocation request invalidates the actual token and possibly other tokens based on the same authorization grant.
The OAuth 2.0 Token Revocation documentation defines the token revocation endpoint.
This endpoint accepts only the HTTP POST method. |
Endpoint: /as/revoke_token.oauth2
Only Internally Managed Reference Tokens support direct access token revocation. JSON web token (JWT) type access tokens do not support direct revocation. JWT access tokens can only be indirectly revoked if the associated refresh token is revoked, and the JWT’s configuration field Access Grant GUID Claim Name is set for the given access token manager instance. However, you can optionally enable direct revocation for self-contained JWT access tokens assigned to them by enabling JWT access token revocation in access token managers. When enabled, the JWTs require a Client ID Claim Name and a minimum JWT ID Claim Length of 22 alphanumeric characters. For more information, see the JSON token management tabbed topic and its description of the Enable Token Revocation check box in Configuring an access token management instance. |
When the authorization server revokes a refresh token, it also revokes the associated access grant and access tokens. When the authorization server revokes an access token, the associated access grant and refresh token remain untouched with the exception of the implicit grant type. If the Reuse Existing Persistent Access Grants for GrantTypes check box is selected in the System → OAuth Settings → Authorization Server Settings window, the implicit access grant will also be revoked with the access token.
The following table describes parameters for this endpoint. The required Content-Type
value is application/x-www-form-urlencoded
when transmitting through the HTTP POST method.
Parameter | Description | ||
---|---|---|---|
(Required) |
The token that the client wants to revoke.
|
||
|
A hint about the type of token submitted for revocation. PingFederate supports values of |
The following table describes parameters for this endpoint. The required Content-Type
value is application/x-www-form-urlencoded
.
OAuth client identification and authentication
The authentication requirement of this endpoint depends on the client authentication method configured for the clients.
Authentication method | Parameters | ||
---|---|---|---|
Client secret |
Clients can present their client identifier and client secret using the HTTP Basic authentication scheme, where the client identifier is the username, and the client secret is the password. Clients can provide credentials using the request parameters
|
||
Client certificate |
Clients must present their client certificate for mutual TLS authentication. The issuer and the subject distinguished name (DN) of the client certificate must match values configured for the clients. |
||
Private key JWT or Client Secret JWT |
Clients must include request parameters
Example ... client_assertion_type= urn%3Aietf%3Aparams%3Aoauth% 3Aclient-assertion-type%3Ajwt-bearer& client_assertion= eyJhbGciOiJSUzI1NiIs...LbSWi1YO-TILOd4L7ZCg& ...
For more information about the private_key_jwt and client_secret_jwt client authentication methods, see Client Authentication and Using Assertions for Client Authentication. |
||
None |
Clients must pass in the |