Revoke refresh tokens

Revoke refresh tokens in bulk by ID list, user, user+client, or user+client+audience.

POST https://{tenantDomain}/api/v2/refresh-tokens/revoke

C#

C#

using Auth0.ManagementApi;
using System.Threading.Tasks;

public partial class Examples
{
    public async Task Example() {
        var client = new ManagementClient(
            token: "<token>"
        );

        await client.RefreshTokens.RevokeAsync(
            new RevokeRefreshTokensRequestContent()
        );
    }

}

Authorizations

bearerAuthoAuth2ClientCredentials

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/jsonapplication/x-www-form-urlencoded

Exactly one of the following combinations must be provided: ids (up to 100 token IDs); user_id; user_id + client_id; or user_id + client_id + audience. ids cannot be combined with user_id, client_id, or audience. audience requires both user_id and client_id. client_id alone is not allowed — it must be paired with user_id.

ids · string[]

Array of refresh token IDs to revoke. Limited to 100 at a time.

Minimum array length: 1

Required string length: 1 - 30

user_id · string<user-id>

Revoke all refresh tokens for this user.

Required string length: 1 - 300

client_id · string<client-id>

Revoke refresh tokens for this client. Must be paired with user_id; optionally narrowed further with audience.

Required string length: 1 - 64

audience · string

Resource server identifier (audience) to scope the revocation. Must be used with both user_id and client_id.

Required string length: 1 - 600

Response

202

Refresh token revocation request accepted.