Skip to content
/Global Token Revocation

Global Token Revocation

The Global Token Revocation API provides a comprehensive solution for managing security across multiple apps and services. This API extends beyond the standard OAuth 2.0 token revocation, enabling the revocation of SSWS tokens and facilitating identity provider (IdP)-initiated sign-out processes.

When you use the API, you revoke all tokens and sessions for a specified user by sending the sub_id in the request body. Use the opaque format for Okta user IDs.

For users authenticated through a SAML or OIDC IdP, use the iss_sub format to identify the user by issuer (iss) and subject (sub). See Manage Early Access and Beta features to enable the feature: Third-Party IdP Global Token Revocation.

Operations

Initiate the global revocation of all tokens and sessions

Request

OAuth 2.0 scope:
  • okta.universalLogout.manage

Initiates the global revocation of all tokens and sessions for a specified user enabling external identity providers to trigger a comprehensive sign-out process. This includes executing IdP-initiated sign-out flows across all apps that are using global token revocation and requiring users to re-authenticate to access protected resources.

Bodyapplication/jsonrequired
sub_idobject(sub_id)
POST
/oauth2/v1/global-token-revocation
curl -i -X POST \
  https://okta-subdomain.pixtulate.com/oauth2/v1/global-token-revocation \
  -H 'Content-Type: application/json' \
  -d '{
    "sub_id": {
      "format": "opaque",
      "id": "00u1dnq5S0CfjlkpABCD"
    }
  }'

Responses

No Content

Response
No content