Skip to main content
POST
https://{tenantDomain}/api/v2
/
refresh-tokens
/
revoke
Revoke refresh tokens
curl --request POST \
  --url https://{tenantDomain}/api/v2/refresh-tokens/revoke \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "ids": [
    "<string>"
  ],
  "user_id": "<string>",
  "client_id": "<string>",
  "audience": "<string>"
}
'

Documentation Index

Fetch the complete documentation index at: https://auth0.com/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

Exactly one of the following combinations must be provided: ids (up to 100 token IDs); user_id; user_id + client_id; user_id + client_id + audience; or client_id alone. ids cannot be combined with user_id, client_id, or audience. audience requires both user_id and client_id.

​
ids
string[]

Array of refresh token IDs to revoke. Limited to 100 at a time.

Minimum array length: 1
Required string length: 1 - 30
​
user_id
string<user-id>

Revoke all refresh tokens for this user.

Required string length: 1 - 300
​
client_id
string<client-id>

Revoke all refresh tokens for this client.

Required string length: 1 - 64
​
audience
string

Resource server identifier (audience) to scope the revocation. Must be used with both user_id and client_id.

Required string length: 1 - 600

Response

Refresh token revocation request accepted.