> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usechar.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke OAuth token

> Revokes an access or refresh token per RFC 7009. Returns success even for invalid tokens to prevent token enumeration.



## OpenAPI

````yaml https://app.usechar.ai/api/spec.json post /revoke
openapi: 3.1.1
info:
  title: Char API
  version: 1.0.0
  description: >-
    REST API for managing organizations, identity providers, end users, skills,
    threads, usage, and subscriptions.


    ## Authentication


    This API uses Bearer token authentication with WorkOS JWT tokens. Include
    the token in the Authorization header:


    ```

    Authorization: Bearer <your-jwt-token>

    ```


    ## Authorization Levels


    - **Public endpoints**: No authentication required

    - **Protected endpoints**: Require valid JWT token (user authentication)

    - **Organization endpoints**: Require valid JWT token with organization
    context selected


    Most endpoints require organization context. Ensure your JWT token includes
    the `org_id` claim.


    ## Data Formats


    ### Allowed Domains

    The `allowed_domains` field is an array of origins (e.g.,
    `https://app.example.com`). It is stored as JSON internally but surfaced as
    an array in the API.


    ### Timestamps

    All timestamps are returned as ISO 8601 strings (e.g.,
    `"2025-01-15T10:30:00.000Z"`).


    ## Rate Limits


    No application-level rate limiting is currently enforced.


    ## Error Responses


    All errors follow a consistent format:


    ```json

    {
      "code": "ERROR_CODE",
      "status": 400,
      "message": "Human-readable error message",
      "data": { /* optional additional details */ }
    }

    ```


    ### Error Codes


    | data.code | Description |

    |-----------|-------------|

    | `VALIDATION_ERROR` | Invalid input data (400) |

    | `AUTH_REQUIRED` | Missing or invalid authentication (401) |

    | `ACCESS_DENIED` | Permission denied (403) |

    | `PAYMENT_REQUIRED` | Subscription required (403) |

    | `ORG_CONTEXT_REQUIRED` | Organization selection required (403) |

    | `RESOURCE_NOT_FOUND` | Resource missing (404) |

    | `DUPLICATE_RESOURCE` | Resource already exists (409) |

    | `INTERNAL_ERROR` | Server-side error (500) |
servers:
  - url: https://app.usechar.ai/api
    description: Production API
security:
  - bearerAuth: []
tags:
  - name: Auth
    description: >-
      Authentication operations including session management and logout. All
      auth endpoints require a valid JWT token.
  - name: Users
    description: >-
      Access the current authenticated user's profile and organization
      memberships.
  - name: Organizations
    description: Organization details, members, and configuration such as allowed domains.
  - name: Identity Providers
    description: Manage SSO configuration and test IDP connectivity.
  - name: Directories
    description: Directory sync resources backed by WorkOS directories.
  - name: End Users
    description: End users who interact with embedded widgets, identified by IDP tokens.
  - name: Organization Skills
    description: CRUD for SKILL.md content following the Agent Skills spec.
  - name: Threads
    description: Conversation thread metadata and management.
  - name: Usage Analytics
    description: Usage and token analytics for the organization.
  - name: Plan Tiers
    description: Plan tiers and limit definitions.
  - name: Subscriptions
    description: Billing and subscription status via Polar integration.
  - name: OAuth
    description: OAuth 2.0 authorization flow endpoints for MCP client authentication.
  - name: OAuth Discovery
    description: RFC 8414/8707 well-known discovery endpoints for OAuth 2.0.
paths:
  /revoke:
    post:
      tags:
        - OAuth
      summary: Revoke OAuth token
      description: >-
        Revokes an access or refresh token per RFC 7009. Returns success even
        for invalid tokens to prevent token enumeration.
      operationId: postRevoke
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - token
              properties:
                token:
                  type: string
                  description: The token to revoke
                token_type_hint:
                  type: string
                  enum:
                    - access_token
                    - refresh_token
                  description: Hint about the type of token being revoked
      responses:
        '200':
          description: Token revoked successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  revoked:
                    description: Whether the token was successfully revoked
                    type: boolean
                required:
                  - revoked
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    description: Error code per RFC 7009
                    type: string
                  error_description:
                    description: Human-readable error description
                    type: string
                required:
                  - error
                  - error_description
        '503':
          description: Service unavailable - retry later
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    description: Error code per RFC 7009
                    type: string
                  error_description:
                    description: Human-readable error description
                    type: string
                required:
                  - error
                  - error_description
      security: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        WorkOS JWT token. Obtain via WorkOS AuthKit authentication flow. The
        token must include organization_id claim for organization-scoped
        endpoints.

````