# Revoke an application's tokens

`POST /v1/applications/{application_id}/tokens:revoke` · permission `sessions:write`

Revokes every active refresh token family issued to the application, for all users. Access tokens issued to the application before the call stop being accepted by introspection and the revocation check. Use it when tokens issued to the application may have leaked: the application must obtain new tokens through a new authorization request.

Sessions, users' consents and the application's credentials are not changed: users' sign-in sessions stay open, so a new authorization request can succeed without signing in again, and consent is not asked again. To stop a leaked client secret from minting new tokens, also rotate the [application's credentials](credentials/create.md). The request has no body. A repeated call succeeds with a zero count. The revocation is written to the management audit log. Send an `Idempotency-Key` header to make retries safe.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `application_id` | path | yes | Application id, prefixed `app_`. |

## Response

`200 OK`.

```json
{
  "revoked_token_families": 318
}
```

`revoked_token_families` is the number of refresh token families revoked by this call.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 400 | `malformed_request`, `unknown_field` | A body was sent and it is not an empty JSON object. |
| 404 | `not_found` | The application does not exist in this environment. |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `sessions:write` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/applications/app_0a1b2c3d4e5f6g7h8j9k0m1n2p/tokens:revoke \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)"
```

CLI: `keenauth applications tokens revoke app_0a1b2c3d4e5f6g7h8j9k0m1n2p --yes`