Revoke access token

POST

/oauth/revoke

const url = 'https://api.pipevest.com/v1/oauth/revoke';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'x-client-id': '<x-client-id>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.pipevest.com/v1/oauth/revoke \
  --header 'Authorization: Bearer <token>' \
  --header 'x-client-id: <x-client-id>'

Blacklist the token in the Authorization header so it is rejected on all future requests. Header-based — no request body or query parameters.

It must be signed, but it is the one mutating endpoint that takes no X-Idempotency-Key, so its signature base must not cover x-idempotency-key, content-type, content-digest or content-length.

Authorizations

bearerAuth
clientId

Responses

200

Token revoked

application/json

object

message

string

Example

{
  "message": "Token revoked successfully"
}

400

Missing, invalid or expired token

application/json

object

error

string

message

string

Example

{
  "error": "Unauthorized",
  "message": "Invalid organization authentication token"
}

401

Authentication failed

application/json

object

error

string

message

string

Example

{
  "error": "Unauthorized",
  "message": "Invalid organization authentication token"
}