/Docs

Revoke Refresh Tokens

This can be used to revoke a centrally managed session, when the refresh token is being used to model a session. Learn more about using refresh tokens to model sessions.

Request#

API Key Authentication
Revoke all Refresh Tokens for an entire Application
DELETE/api/jwt/refresh?applicationId={applicationId}
OpenAPI Spec

Request Parameters#

applicationIdUUIDrequired

The Id of the application to revoke all issued Refresh Tokens. This will result in any user issued a Refresh Token for this application being required to be issued a new Refresh Token, in other words they'll need to be authenticated again.

This essentially provides a kill switch for all Refresh Tokens scoped to the application.

Request Headers#

X-FusionAuth-TenantIdStringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

API Key Authentication
Revoke all Refresh Tokens issued to a User
DELETE/api/jwt/refresh?userId={userId}
OpenAPI Spec

Request Parameters#

userIdUUIDrequired

The Id of the user to revoke issued Refresh Tokens.

Request Headers#

X-FusionAuth-TenantIdStringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

API Key Authentication
Revoke all Refresh Tokens issued to a User for an Application
DELETE/api/jwt/refresh?applicationId={applicationId}&userId={userId}
OpenAPI Spec

Available Since Version 1.19.0

Request Parameters#

applicationIdUUIDrequired

The Id of the application.

userIdUUIDrequired

The Id of the user.

Request Headers#

X-FusionAuth-TenantIdStringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

JWT Authentication
Revoke a single Refresh Token by Id
DELETE/api/jwt/refresh/{tokenId}
OpenAPI Spec

This API may be authenticated using a JWT or an API key. If using JWT authentication, the JWT owner and token owner must match. See Authentication for examples of authenticating using a JWT.

Request Parameters#

tokenIdUUIDrequired

The Id of the refresh token to be revoked.

When deleting a single token, using this parameter is recommended. Using this parameter does not expose the refresh token.

JWT Authentication
Revoke a single Refresh Token by value
DELETE/api/jwt/refresh?token={token}
OpenAPI Spec

This API may be authenticated using a JWT or an API key. If using JWT authentication, the JWT owner and token owner must match. See Authentication for examples of authenticating using a JWT.

Request Parameters#

tokenStringrequired

The refresh token in string form that is to be revoked. This string may contain characters such as a plus sign that need to be encoded to be valid on the URL. If you're manually building this request ensure you are properly URL encoding this value.

You can also pass the refresh token in the HTTP body by specifying a Content-Type header of application/x-www-form-urlencoded and providing the proper URL encoded value for the parameter. This will prevent the refresh token from being written to HTTP access logs.

If possible, it is recommended use the tokenId parameter rather than this one.

Request Headers#

X-FusionAuth-TenantIdStringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response#

This API does not return a JSON response body.

Response Codes
CodeDescription
200The request was successful.
401You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404The object you requested doesn't exist. The response will be empty.
500There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.