# Revoke an access or refresh token

`POST /oauth/revoke`

This operation is idempotent. It returns `200 {}` whether or not the token was valid, which prevents token enumeration.

## Request body (`application/x-www-form-urlencoded`)

- `object`
  - `client_id` (`string`) - The OAuth application UID.
  - `client_secret` (`string`) - The OAuth application secret.
  - `token` (`string`) - The access or refresh token value to revoke.
  - `token_type_hint` (`string`) - enum: `access_token`, `refresh_token`; The type of token supplied in `token`.

### Example

```json
{
  "client_id": "example_client_id",
  "client_secret": "carebit_cs_live_example_client_secret",
  "token": "carebit_at_live_example_access_token",
  "token_type_hint": "access_token"
}
```

## Response `200`

The token was revoked, or was already invalid.

- `object` - An empty object returned whether or not the token was valid. This prevents token enumeration.

### Example

```json
{}
```

## Response `401`

The client credentials are invalid.

- `object`
  - `error` (`object`) - The structured details that describe why the request failed.
    - `code` (`string`) - The machine-readable error code.
    - `errors` (`array | null`) - Additional errors from a failed validation.
      - `items` (`object`)
        - `code` (`string`) - The machine-readable code for this validation error.
        - `message` (`string`) - A message that explains this validation error.
        - `param` (`string | null`) - The name of the parameter that caused this validation error, when known.
    - `message` (`string`) - A message that explains the error and how to resolve it.
    - `param` (`string | null`) - The name of the parameter that caused the error, when known.
    - `type` (`string`) - enum: `authentication_error`, `permission_error`, `invalid_request_error`, `rate_limit_error`, `api_error`; The high-level category of the error.

### Example

```json
{
  "error": {
    "code": "resource_missing",
    "errors": [
      {
        "code": "resource_missing",
        "message": "The requested resource was not found.",
        "param": "patient_id"
      }
    ],
    "message": "The requested resource was not found.",
    "param": "patient_id",
    "type": "authentication_error"
  }
}
```

## Code samples

```bash
curl -X POST "https://api.carebit.co/oauth/revoke" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "client_id=example_client_id" \
  --data-urlencode "client_secret=carebit_cs_live_example_client_secret" \
  --data-urlencode "token=carebit_at_live_example_access_token" \
  --data-urlencode "token_type_hint=access_token"
```

```javascript
const response = await fetch("https://api.carebit.co/oauth/revoke", {
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded",
  },
  body: new URLSearchParams({
  "client_id": "example_client_id",
  "client_secret": "carebit_cs_live_example_client_secret",
  "token": "carebit_at_live_example_access_token",
  "token_type_hint": "access_token",
}),
});

if (!response.ok) {
  throw new Error(`Carebit API error: ${response.status}`);
}

const data = await response.json();
```

```python
import os
import requests

response = requests.post(
    "https://api.carebit.co/oauth/revoke",
    data={
        "client_id": "example_client_id",
        "client_secret": "carebit_cs_live_example_client_secret",
        "token": "carebit_at_live_example_access_token",
        "token_type_hint": "access_token"
    }
)
response.raise_for_status()
data = response.json()
```

```ruby
require "httparty"

response = HTTParty.post(
  "https://api.carebit.co/oauth/revoke",
  body: {
    "client_id" => "example_client_id",
    "client_secret" => "carebit_cs_live_example_client_secret",
    "token" => "carebit_at_live_example_access_token",
    "token_type_hint" => "access_token"
  }
)
raise "Carebit API error: #{response.code}" unless response.success?
data = response.parsed_response
```

```php
<?php

$client = new GuzzleHttp\Client();

$response = $client->post("https://api.carebit.co/oauth/revoke", [
    "form_params" => [
      "client_id" => "example_client_id",
      "client_secret" => "carebit_cs_live_example_client_secret",
      "token" => "carebit_at_live_example_access_token",
      "token_type_hint" => "access_token"
    ]
]);
$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR);
```