Skip to content
Port OS

Revoke a delegated REST or MCP grant

← HTTP API reference
View source specification ↗
POST /auth/revoke

Possession of the matching refresh token proves revocation authority. The endpoint invalidates the grant family; it does not delete the client or other users' grants.

Required scope

Not required

Request body

Fields

tokenstringRequired
client_idstringRequired

Returns

200

Grant revoked or token was already invalid.

No response body.

Errors

400

Invalid request or client mismatch.

Check the request fields and any validation details, then correct the payload.

503

Revocation storage unavailable; do not claim success.

Wait for the provider or bridge to recover, then retry safely with backoff.