> For the complete documentation index, see [llms.txt](https://fusionauth.io/docs/llms.txt)

# Revoke Refresh Tokens

API documentation for the FusionAuth Revoke Refresh Tokens API.

# Revoke Refresh Tokens

This can be used to revoke a centrally managed session, when the refresh token is being used to model a session. [Learn more about using refresh tokens to model sessions](https://fusionauth.io/docs/lifecycle/authenticate-users/logout-session-management.md).

## Request

[!API Key Authentication](https://fusionauth.io/docs/apis/authentication.md#api-key-authentication)

Revoke all Refresh Tokens for an entire Application

DELETE/api/jwt/refresh?applicationId={applicationId}

OpenAPI Spec

### Request Parameters

`applicationId`UUIDrequired

The Id of the application to revoke all issued Refresh Tokens. This will result in any user issued a Refresh Token for this application being required to be issued a new Refresh Token, in other words they'll need to be authenticated again.

This essentially provides a kill switch for all Refresh Tokens scoped to the application.

#### Request Headers

`X-FusionAuth-TenantId`Stringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See [Making an API request using a Tenant Id](https://fusionauth.io/docs/apis/authentication.md#making-an-api-request-using-a-tenant-id) for additional information.

[!API Key Authentication](https://fusionauth.io/docs/apis/authentication.md#api-key-authentication)

Revoke all Refresh Tokens issued to a User

DELETE/api/jwt/refresh?userId={userId}

OpenAPI Spec

### Request Parameters

`userId`UUIDrequired

The Id of the user to revoke issued Refresh Tokens.

#### Request Headers

`X-FusionAuth-TenantId`Stringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See [Making an API request using a Tenant Id](https://fusionauth.io/docs/apis/authentication.md#making-an-api-request-using-a-tenant-id) for additional information.

[!API Key Authentication](https://fusionauth.io/docs/apis/authentication.md#api-key-authentication)

Revoke all Refresh Tokens issued to a User for an Application

DELETE/api/jwt/refresh?applicationId={applicationId}&userId={userId}

OpenAPI Spec

version

Available Since Version 1.19.0

### Request Parameters

`applicationId`UUIDrequired

The Id of the application.

`userId`UUIDrequired

The Id of the user.

#### Request Headers

`X-FusionAuth-TenantId`Stringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See [Making an API request using a Tenant Id](https://fusionauth.io/docs/apis/authentication.md#making-an-api-request-using-a-tenant-id) for additional information.

[!JWT Authentication](https://fusionauth.io/docs/apis/authentication.md#jwt-authentication)

Revoke a single Refresh Token by Id

DELETE/api/jwt/refresh/{tokenId}

OpenAPI Spec

This API may be authenticated using a JWT or an API key. If using JWT authentication, the JWT owner and token owner must match. See [Authentication](https://fusionauth.io/docs/apis/authentication.md) for examples of authenticating using a JWT.

### Request Parameters

`tokenId`UUIDrequired

The Id of the refresh token to be revoked.

When deleting a single token, using this parameter is recommended. Using this parameter does not expose the refresh token.

[!JWT Authentication](https://fusionauth.io/docs/apis/authentication.md#jwt-authentication)

Revoke a single Refresh Token by value

DELETE/api/jwt/refresh?token={token}

OpenAPI Spec

This API may be authenticated using a JWT or an API key. If using JWT authentication, the JWT owner and token owner must match. See [Authentication](https://fusionauth.io/docs/apis/authentication.md) for examples of authenticating using a JWT.

### Request Parameters

`token`Stringrequired

The refresh token in string form that is to be revoked. This string may contain characters such as a plus sign that need to be encoded to be valid on the URL. If you're manually building this request ensure you are properly URL encoding this value.

You can also pass the refresh token in the HTTP body by specifying a Content-Type header of `application/x-www-form-urlencoded` and providing the proper URL encoded value for the parameter. This will prevent the refresh token from being written to HTTP access logs.

If possible, it is recommended use the **tokenId** parameter rather than this one.

#### Request Headers

`X-FusionAuth-TenantId`Stringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See [Making an API request using a Tenant Id](https://fusionauth.io/docs/apis/authentication.md#making-an-api-request-using-a-tenant-id) for additional information.

## Response

This API does not return a JSON response body.

*Response Codes*

| Code | Description |
| --- | --- |
| 200 | The request was successful. |
| 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](https://fusionauth.io/docs/apis/authentication.md). |
| 404 | The object you requested doesn't exist. The response will be empty. |
| 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. |
| 503 | The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body. |