> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hq.zone/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke a token

> RFC 7009 token revocation: the calling client authenticates (client_id, plus
client_secret for confidential clients) and submits a token to revoke, as form or
JSON. If the token belongs to the authenticating client, it and its entire refresh
family (the paired access and refresh tokens plus all rotations) are revoked. Always
returns 200, including for unknown, already-revoked, or not-owned tokens, so it
never reveals whether a token exists or who owns it.

## Token revocation (RFC 7009)

Revokes an access or refresh token. Send the token as a form field `token` (**`application/x-www-form-urlencoded`**). Per the spec it returns success even if the token was already invalid or unknown.


## OpenAPI

````yaml POST /v1/oauth/revoke
openapi: 3.1.0
info:
  title: HQ API
  description: >-
    Public HTTP API for HQ. Authenticate with a Personal Access Token
    (`Authorization: Bearer hq_pat_...`) for server-side integrations, or an
    OAuth 2.1 authorization-code + PKCE flow for browser apps acting on a user's
    behalf. Both grant from the same resource:action scope vocabulary; an
    endpoint's required scope is listed under its `security`.
  license:
    name: Apache-2.0
    identifier: Apache-2.0
  version: 1.0.0
servers:
  - url: https://api.hq.zone
    description: HQ API (production)
security: []
tags:
  - name: me
    description: The signed-in user's own account
  - name: conversations
    description: Conversations and their messages
  - name: documents
    description: The content-addressed documents library
  - name: schedules
    description: Scheduled prompts and recurring tasks
  - name: agents
    description: Agents, their skills and integrations
  - name: memory
    description: What the assistant remembers (L5 governance)
  - name: tokens
    description: Personal Access Token management
  - name: billing
    description: Usage and billing
  - name: notifications
    description: In-app notification center
  - name: admin
    description: Workspace administration
  - name: integrations
    description: Workspace integrations (Slack, MCP, skills)
  - name: onboarding
    description: New-workspace onboarding wizard
  - name: auth
    description: Sign-in, sessions, and OAuth
paths:
  /v1/oauth/revoke:
    post:
      tags:
        - auth
      summary: Revoke a token
      description: >-
        RFC 7009 token revocation: the calling client authenticates (client_id,
        plus

        client_secret for confidential clients) and submits a token to revoke,
        as form or

        JSON. If the token belongs to the authenticating client, it and its
        entire refresh

        family (the paired access and refresh tokens plus all rotations) are
        revoked. Always

        returns 200, including for unknown, already-revoked, or not-owned
        tokens, so it

        never reveals whether a token exists or who owns it.
      operationId: oauth_revoke
      requestBody:
        description: >-
          RFC 7009. Revokes the token and its refresh family. Form or JSON.
          Always returns 200.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeReq'
        required: true
      responses:
        '200':
          description: Revoked (unknown / not-yours / already-revoked all return 200)
        '401':
          description: Invalid client credentials
        '429':
          description: Too many requests (per-IP rate limit)
components:
  schemas:
    RevokeReq:
      type: object
      required:
        - token
        - client_id
      properties:
        client_id:
          type: string
        client_secret:
          type:
            - string
            - 'null'
        token:
          type: string
        token_type_hint:
          type:
            - string
            - 'null'

````