/api/apps/{app_id}/authorizeAuthenticatedRevoke a client application's authorization
Withdraws the caller's consent for a client application to receive tokens on their behalf, and revokes the app's unexpired access and refresh tokens issued for the caller. From then on the app's refresh tokens are refused at the token endpoint, token introspection reports its tokens inactive, and signing in to the app asks for consent again. Idempotent: was_authorized is false when there was nothing to revoke. The auth server's own app is always authorized and cannot be de-authorized (403).
delete_api_apps_app_id_authorizeClient applicationsAuthentication & permissionsAuthenticated
Any authenticated user
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Any authenticated user
Path parameters
| Name | Type | Description |
|---|---|---|
| app_id* | string | Client application id |
Responses
| Property | Type | Description |
|---|---|---|
| success* | true | |
| message* | string | |
| resource_id* | string | The client application id |
| was_authorized* | boolean | Whether the caller had authorized the app before this request; false means there was nothing to revoke |
| revoked_token_count* | integer | How many of the app's unexpired access and refresh tokens issued on the caller's behalf this request revoked; tokens already revoked (e.g. by logout) are not counted minimum: 0 |
Example request
curl -X DELETE 'https://auth.schemavaults.com/api/apps/<app_id>/authorize' \
-b 'refresh_token_<auth_server_app_id>=<value>'