/oauth/revokeRevoke a refresh token (RFC 7009) — 'Disconnect'
Revokes the presented refresh token and its whole rotation family after matching it to the already registered client. Disconnect remains available if a trusted remote client metadata document is temporarily unreachable; this local revocation path cannot authorize or refresh a token. Always returns 200 per RFC 7009.
free
Parameters
| Name | In | Required | Default | Allowed | Description | Example |
|---|---|---|---|---|---|---|
| token | body | required | — | — | The refresh token to revoke. | <refresh token> |
| client_id | body | required | — | — | The client identifier that owns the refresh token. Public PKCE clients authenticate revocation with this identifier. | <registered client id> |
| client_secret | body | optional | — | — | Required only for a confidential client that was registered with a secret; public PKCE clients omit it. | <client secret> |
Response schema
| Field | Type | Nullable | Description |
|---|---|---|---|
| (empty body) | none | no | HTTP 200 with an EMPTY body, always (RFC 7009) — the endpoint never reveals whether the token existed or was owned by the caller (no oracle). If the token and its client match a live rotation family, that family is revoked; otherwise the call is a no-op. There is no JSON response payload. |
Errors
| Status | Label | Description |
|---|---|---|
| 200 | OK | Request succeeded. |
| 400 | Bad Request | Invalid query, body, or path parameter. |
| 401 | Unauthorized | Missing or invalid Authorization header / api_Token. |
| 402 | Payment Required | Insufficient token balance for this call. Top up |
| 429 | Too Many Requests | Rate limit exceeded for your tier (see /pricing for tier limits). Tier limits |
| 500 | Server Error | Unexpected server-side failure. Retry with backoff; report if persistent. |
Code samples
curl -X POST "https://api.finradar.ai/oauth/revoke" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d 'token=%3Crefresh+token%3E&client_id=%3Cregistered+client+id%3E&client_secret=%3Cclient+secret%3E'Generate an API key in /account/credentials to run live queries (literal YOUR_API_KEY placeholder shown until then).