Invalidate a token

DELETE /_security/oauth2/token

Auth

The access tokens returned by the get token API have a finite period of time for which they are valid. After that time period, they can no longer be used. The time period is defined by the xpack.security.authc.token.timeout setting.

The refresh tokens returned by the get token API are only valid for 24 hours. They can also be used exactly once. If you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API.

Note

While all parameters are optional, at least one of them is required. More specifically, either one of token or refresh_token parameters is required. If none of these two are specified, then realm_name and/or username need to be specified.

Request body

token string: An access token. This parameter cannot be used if any of refresh_token, realm_name, or username are used.
refresh_token string: A refresh token. This parameter cannot be used if any of refresh_token, realm_name, or username are used.
realm_name string: The name of an authentication realm. This parameter cannot be used with either refresh_token or token.
username string: The username of a user. This parameter cannot be used with either refresh_token or token.

Response

application/json

error_count number required: The number of errors that were encountered when invalidating the tokens.
error_details object[]: Details about the errors. This field is not present in the response when error_count is 0.
invalidated_tokens number required: The number of the tokens that were invalidated as part of this request.
previously_invalidated_tokens number required: The number of tokens that were already invalidated.

Examples

Request Console 1 / 8 languages

Run DELETE /_security/oauth2/token to invalidate an access token.

Console Kibana Dev Tools

DELETE /_security/oauth2/token
{
  "token" : "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ=="
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.invalidateToken({
  token:
    "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==",
});

Python Elasticsearch Python Client

resp = client.security.invalidate_token(
    token="dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==",
)

curl Shell

curl -X DELETE "$ELASTICSEARCH_URL/_security/oauth2/token" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ=="
  }'

Java Elasticsearch Java Client

client.security().invalidateToken(i -> i
    .token("dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .InvalidateTokenAsync(d1 => d1
        .Token("dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->invalidateToken([
    "body" => [
        "token" => "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.invalidate_token(
  body: {
    "token": "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ=="
  }
)

Response

A partially successful response from DELETE /_security/oauth2/token. The response includes the number of the tokens that were invalidated, the number of errors that were encountered when invalidating the tokens, and details about these errors.

{
  "invalidated_tokens":9, 
  "previously_invalidated_tokens":15, 
  "error_count":2, 
  "error_details":[ 
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=foo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=bar]"
      }
    },
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=boo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=far]"
      }
    }
  ]
}

Request Console 1 / 8 languages

Run DELETE /_security/oauth2/token to invalidate a refresh token.

Console Kibana Dev Tools

DELETE /_security/oauth2/token
{
  "refresh_token" : "vLBPvmAB6KvwvJZr27cS"
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.invalidateToken({
  refresh_token: "vLBPvmAB6KvwvJZr27cS",
});

Python Elasticsearch Python Client

resp = client.security.invalidate_token(
    refresh_token="vLBPvmAB6KvwvJZr27cS",
)

curl Shell

curl -X DELETE "$ELASTICSEARCH_URL/_security/oauth2/token" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_token": "vLBPvmAB6KvwvJZr27cS"
  }'

Java Elasticsearch Java Client

client.security().invalidateToken(i -> i
    .refreshToken("vLBPvmAB6KvwvJZr27cS")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .InvalidateTokenAsync(d1 => d1
        .RefreshToken("vLBPvmAB6KvwvJZr27cS")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->invalidateToken([
    "body" => [
        "refresh_token" => "vLBPvmAB6KvwvJZr27cS",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.invalidate_token(
  body: {
    "refresh_token": "vLBPvmAB6KvwvJZr27cS"
  }
)

Response

A partially successful response from DELETE /_security/oauth2/token. The response includes the number of the tokens that were invalidated, the number of errors that were encountered when invalidating the tokens, and details about these errors.

{
  "invalidated_tokens":9, 
  "previously_invalidated_tokens":15, 
  "error_count":2, 
  "error_details":[ 
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=foo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=bar]"
      }
    },
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=boo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=far]"
      }
    }
  ]
}

Request Console 1 / 8 languages

Run DELETE /_security/oauth2/token to invalidate all access tokens and refresh tokens for the saml1 realm.

Console Kibana Dev Tools

DELETE /_security/oauth2/token
{
  "realm_name" : "saml1"
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.invalidateToken({
  realm_name: "saml1",
});

Python Elasticsearch Python Client

resp = client.security.invalidate_token(
    realm_name="saml1",
)

curl Shell

curl -X DELETE "$ELASTICSEARCH_URL/_security/oauth2/token" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "realm_name": "saml1"
  }'

Java Elasticsearch Java Client

client.security().invalidateToken(i -> i
    .realmName("saml1")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .InvalidateTokenAsync(d1 => d1
        .RealmName("saml1")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->invalidateToken([
    "body" => [
        "realm_name" => "saml1",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.invalidate_token(
  body: {
    "realm_name": "saml1"
  }
)

Response

A partially successful response from DELETE /_security/oauth2/token. The response includes the number of the tokens that were invalidated, the number of errors that were encountered when invalidating the tokens, and details about these errors.

{
  "invalidated_tokens":9, 
  "previously_invalidated_tokens":15, 
  "error_count":2, 
  "error_details":[ 
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=foo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=bar]"
      }
    },
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=boo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=far]"
      }
    }
  ]
}

Request Console 1 / 8 languages

Run DELETE /_security/oauth2/token to invalidate all access tokens and refresh tokens for the user myuser in all realms.

Console Kibana Dev Tools

DELETE /_security/oauth2/token
{
  "username" : "myuser"
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.invalidateToken({
  username: "myuser",
});

Python Elasticsearch Python Client

resp = client.security.invalidate_token(
    username="myuser",
)

curl Shell

curl -X DELETE "$ELASTICSEARCH_URL/_security/oauth2/token" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myuser"
  }'

Java Elasticsearch Java Client

client.security().invalidateToken(i -> i
    .username("myuser")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .InvalidateTokenAsync(d1 => d1
        .Username("myuser")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->invalidateToken([
    "body" => [
        "username" => "myuser",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.invalidate_token(
  body: {
    "username": "myuser"
  }
)

Response

A partially successful response from DELETE /_security/oauth2/token. The response includes the number of the tokens that were invalidated, the number of errors that were encountered when invalidating the tokens, and details about these errors.

{
  "invalidated_tokens":9, 
  "previously_invalidated_tokens":15, 
  "error_count":2, 
  "error_details":[ 
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=foo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=bar]"
      }
    },
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=boo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=far]"
      }
    }
  ]
}

Request Console 1 / 8 languages

Run DELETE /_security/oauth2/token to invalidate all access tokens and refresh tokens for the user myuser in the saml1 realm.

Console Kibana Dev Tools

DELETE /_security/oauth2/token
{
  "username" : "myuser",
  "realm_name" : "saml1"
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.invalidateToken({
  username: "myuser",
  realm_name: "saml1",
});

Python Elasticsearch Python Client

resp = client.security.invalidate_token(
    username="myuser",
    realm_name="saml1",
)

curl Shell

curl -X DELETE "$ELASTICSEARCH_URL/_security/oauth2/token" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myuser",
    "realm_name": "saml1"
  }'

Java Elasticsearch Java Client

client.security().invalidateToken(i -> i
    .realmName("saml1")
    .username("myuser")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .InvalidateTokenAsync(d1 => d1
        .RealmName("saml1")
        .Username("myuser")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->invalidateToken([
    "body" => [
        "username" => "myuser",
        "realm_name" => "saml1",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.invalidate_token(
  body: {
    "username": "myuser",
    "realm_name": "saml1"
  }
)

Response

A partially successful response from DELETE /_security/oauth2/token. The response includes the number of the tokens that were invalidated, the number of errors that were encountered when invalidating the tokens, and details about these errors.

{
  "invalidated_tokens":9, 
  "previously_invalidated_tokens":15, 
  "error_count":2, 
  "error_details":[ 
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=foo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=bar]"
      }
    },
    {
      "type":"exception",
      "reason":"Elasticsearch exception [type=exception, reason=boo]",
      "caused_by":{
        "type":"exception",
        "reason":"Elasticsearch exception [type=illegal_argument_exception, reason=far]"
      }
    }
  ]
}