> ## Documentation Index
> Fetch the complete documentation index at: https://team.k0labs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke token

> **Visibility:** `public` · `internal` ( OpenAPI Custom Extension: x-visibility )

Explicitly revoke an access token before its natural expiration.
Once revoked, the token is added to a server-side deny list and
will fail introspection checks immediately.

Callers can revoke their own tokens. Tenant administrators can
revoke any token within the tenant.

Inspired by RFC 7009 but uses application/json instead of
form-encoded requests. This endpoint returns 200 even if the token is
already expired, revoked, or unrecognized. This prevents
information leakage about token validity.

Resource servers that enforce real-time revocation must call
the introspect endpoint for sensitive operations, as
self-contained JWT signature verification alone will not
detect revoked tokens.




## OpenAPI

````yaml api-docs/k0rdent-api.json post /v1/regions/global/auth/revoke
openapi: 3.1.0
info:
  title: K0rdent AI API
  version: 0.2.0-draft
  description: >
    OpenAPI specification for the K0rdent AI GPU-as-a-Service platform.

    **Custom Extensions:**

    - `x-visibility`: Endpoint visibility — `internal` (Atlas only), `public`
    (Arc only), `[internal, public]` (common)

    - `x-status`: Implementation status — `mvp`, `tbd`, `blocked`, `stretch`

    - `x-source`: Source document reference or `TBD` for fields pending
    confirmation

    **Error Model:** Standard `{ error: { code, message, details[] } }`
    envelope.

    **Pagination:** All list endpoints support two modes:

    - **Cursor** (`pageToken` + `pageSize`): Use for frequently updated
    resources. Prevents skipped or duplicated items across pages.
    `nextPageToken` is returned; `total` is not.

    - **Offset** (`offset` + `pageSize`): Use for stable resources. Returns
    `total` for page-count UIs. `nextPageToken` is not returned.

    `pageToken` and `offset` are mutually exclusive. Default `pageSize` is 50,
    maximum is 500.
servers:
  - url: https://api.k0rdent.ai
    description: K0rdent AI API Gateway
security:
  - bearerAuth: []
tags:
  - name: clusters
    description: Kubernetes cluster management
  - name: kubeconfigs
    description: Kubeconfig issuance and management
  - name: instances
    description: VM and baremetal instance lifecycle
  - name: networks
    description: Network configuration and topology
  - name: addresses
    description: IP address management
  - name: servers
    description: Bare metal server lifecycle management
  - name: organizations
    description: Organization (tenant) management
  - name: projects
    description: Project resource grouping
  - name: authentication
    description: Authentication and session management
  - name: users
    description: User management
  - name: groups
    description: User group management
  - name: roles
    description: RBAC role definitions
  - name: policies
    description: IAM policy bindings
  - name: providers
    description: Identity provider configuration
  - name: token
    description: >
      Generate access token via multiple grant types (authorization_code,
      api_key, client_credentials).
  - name: check
    description: >
      Evaluate permissions for a principal against actions and resources.
      Supports single and bulk checks (up to 100).
  - name: introspect
    description: >
      Token introspection per RFC 7662. Validate token activity and retrieve
      full decoded claims.
  - name: revoke
    description: >
      Token revocation per RFC 7009. Explicitly invalidate access tokens before
      natural expiration.
  - name: sessions
    description: >
      Manage user browser sessions. Supports listing active sessions, creating a
      new session (login), and ending the current session (logout).
  - name: apikeys
    description: >
      Manage API keys for programmatic access. API keys are bound to a user and
      inherit a dynamic subset of the user's privileges, evaluated at token-mint
      time.

      Keys are scoped to a level in the resource hierarchy (organization, or
      project).
  - name: serviceaccounts
    description: |
      Manage service accounts for machine-to-machine and infrastructure
      access. Service accounts are independent principals with their own
      identity, role bindings, and credentials. They survive user
      off-boarding and are managed exclusively by tenant administrators.
paths:
  /v1/regions/global/auth/revoke:
    post:
      tags:
        - revoke
      summary: Revoke token
      description: >
        **Visibility:** `public` · `internal` ( OpenAPI Custom Extension:
        x-visibility )


        Explicitly revoke an access token before its natural expiration.

        Once revoked, the token is added to a server-side deny list and

        will fail introspection checks immediately.


        Callers can revoke their own tokens. Tenant administrators can

        revoke any token within the tenant.


        Inspired by RFC 7009 but uses application/json instead of

        form-encoded requests. This endpoint returns 200 even if the token is

        already expired, revoked, or unrecognized. This prevents

        information leakage about token validity.


        Resource servers that enforce real-time revocation must call

        the introspect endpoint for sensitive operations, as

        self-contained JWT signature verification alone will not

        detect revoked tokens.
      operationId: revokeToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - token
              properties:
                token:
                  type: string
                  description: The access token (JWT) to revoke.
      responses:
        '200':
          description: |
            Token revocation accepted. Per RFC 7009, this status is
            returned regardless of whether the token was valid,
            already revoked, or unrecognized.
          content:
            application/json:
              schema:
                type: object
                properties:
                  revoked:
                    type: boolean
                    description: Always true on successful processing.
                    enum:
                      - true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  responses:
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      description: Standard error response
      properties:
        error:
          type: object
          properties:
            code:
              type: integer
              description: HTTP status code
            message:
              type: string
              description: Error message
            details:
              type: array
              items:
                type: object
              description: Additional error details
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token authentication using OAuth2/OIDC tokens

````