Revoke Token

Revokes a personal API token, following RFC 7009: the call always returns 200, even for unknown or already-revoked tokens, so revocation can never leak whether a token existed.

The body is form-encoded (application/x-www-form-urlencoded). Use this when decommissioning an integration or responding to a suspected leak. For routine rotation, prefer the token management API, which can also revoke other tokens on the account by ID.

Requirements: none beyond possessing the token value to revoke.

Request

tokenstringbodyrequired

The ot_pat_... token to revoke.

Response

200 with an empty JSON body. The token stops authenticating immediately.

Errors

Status	error	Meaning
400	invalid_request	The token field is missing
500	server_error	Unexpected failure

Request examples

curl

curl -sS -X POST https://app.opentrain.ai/api/agent/oauth/revoke \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "token=ot_pat_..."

Response examples

200

{}