Type to search.

Invalidate a token

  • DELETE /_security/oauth2/token
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 5.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The access tokens returned by the get token API have a finite period of time for which they are valid. After that time period, they can no longer be used. The time period is defined by the xpack.security.authc.token.timeout setting.

The refresh tokens returned by the get token API are only valid for 24 hours. They can also be used exactly once. If you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API.

Note

While all parameters are optional, at least one of them is required. More specifically, either one of token or refresh_token parameters is required. If none of these two are specified, then realm_name and/or username need to be specified.

Request body

token string

An access token. This parameter cannot be used if any of refresh_token, realm_name, or username are used.

refresh_token string

A refresh token. This parameter cannot be used if any of refresh_token, realm_name, or username are used.

realm_name string

The name of an authentication realm. This parameter cannot be used with either refresh_token or token.

username string

The username of a user. This parameter cannot be used with either refresh_token or token.

Response

application/json
error_count number required

The number of errors that were encountered when invalidating the tokens.

invalidated_tokens number required

The number of the tokens that were invalidated as part of this request.

previously_invalidated_tokens number required

The number of tokens that were already invalidated.