Back to API Practice

Security/Auth trainer

Token Revocation API Practice

Practice explicit token revocation, token-family invalidation, propagation delay, protected API replay checks, permissions, and audit trails.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated POST /api/auth/tokens/revoke request, inspect the fake response, and turn it into test ideas.

No real tokens are sent. This is a safe client-side simulator with placeholder token IDs.

Request

Build the request

POST/api/auth/tokens/revoke

Request JSON

application/json
{
  "tokenId": "tok_refresh_123",
  "scope": "token-family",
  "reason": "user_requested"
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Token lifecycle

Validation

Permissions

Reliability

Idempotency

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List valid revocation, revoked-token replay, refresh token family, missing permissions, tenant scope, propagation delay, duplicate revoke, outages, audit logs, metrics, and no token leakage.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Token Revocation endpoint

Revoke access or refresh tokens while enforcing permissions, token-family rules, propagation behavior, and safe audit trails.

Endpoint

POST/api/auth/tokens/revoke

Purpose

Revoke access or refresh tokens while enforcing permissions, token-family rules, propagation behavior, and safe audit trails.

Request fields

  • tokenId: opaque token identifier
  • scope: single-token or token-family
  • reason: user_requested, admin_action, password_change
  • actorId: derived from auth context

Success response

204 No Content

Request body

{
  "tokenId": "tok_refresh_123",
  "scope": "token-family",
  "reason": "user_requested"
}

Example response body

{
  "status": "revoked",
  "revokedAt": "2026-07-17T10:00:00Z",
  "scope": "token-family"
}

Errors

  • 400 validation error
  • 401 missing/invalid caller token
  • 403 forbidden token owner or tenant
  • 404 safe not found
  • 409 already revoked
  • 503 token store unavailable

Security notes

  • Do not log token values
  • Do not send token IDs to analytics
  • Replay with revoked credentials is denied
  • Tenant and owner boundaries are enforced

Business rules

  • Revoked tokens are rejected on protected APIs
  • Token-family revocation invalidates related refresh tokens
  • Access-token cache propagation is documented
  • Duplicate revocation is idempotent or safely rejected
  • Audit logs include actor and revocation source