Revoke a user's consent
DELETE /v1/users/{user_id}/consents/{consent_id} · permission users:write
Revokes an OAuth consent the user granted to an application. The user's refresh token families for that application are revoked, access tokens issued before the call stop being accepted by introspection and the revocation check, and the application's next authorization request asks the user for consent again. The user's sessions and other applications are not affected. The revocation is written to the management audit log as consent.revoked.
Revoking a consent that is already revoked returns 404.
Request
| Parameter | In | Required | Description |
|---|---|---|---|
user_id |
path | yes | User id, prefixed usr_. |
consent_id |
path | yes | Consent id, prefixed cns_ (from List a user's consents). |
Response
204 No Content.
Errors
Every error is an application/problem+json body with a stable code.
| HTTP | code |
When |
|---|---|---|
| 404 | not_found |
The user does not exist in this environment, or the consent does not exist, belongs to another user or is already revoked. |
| 401 | unauthenticated |
The API key is missing, invalid or revoked. |
| 403 | insufficient_permissions |
The key lacks the users:write permission. |
| 429 | rate_limited |
The rate limit was exceeded; honor Retry-After. |
| 503 | service_unavailable |
A dependency is temporarily unavailable; retry later. |
Example
curl -X DELETE https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/consents/cns_01jb2k8m5c3f6t9w2y4b7d0g3k \
-H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
CLI: keenauth users consents delete usr_0a1b2c3d4e5f6g7h8j9k0m1n2p cns_01jb2k8m5c3f6t9w2y4b7d0g3k --yes
Personal data
This endpoint carries personal data: consent records. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.