# Invalidate a token

**DELETE /_security/oauth2/token**

The access tokens returned by the get token API have a finite period of time for which they are valid.
After that time period, they can no longer be used.
The time period is defined by the `xpack.security.authc.token.timeout` setting.

The refresh tokens returned by the get token API are only valid for 24 hours.
They can also be used exactly once.
If you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API.

NOTE: While all parameters are optional, at least one of them is required.
More specifically, either one of `token` or `refresh_token` parameters is required.
If none of these two are specified, then `realm_name` and/or `username` need to be specified.


## Servers
- http://api.example.com: http://api.example.com ()


## Authentication methods
- Api key auth
- Basic auth
- Bearer auth


## Parameters



### Body: application/json (object)

- **token** (string)
  An access token.
  This parameter cannot be used if any of `refresh_token`, `realm_name`, or `username` are used.
- **refresh_token** (string)
  A refresh token.
  This parameter cannot be used if any of `refresh_token`, `realm_name`, or `username` are used.
- **realm_name** (string)
  The name of an authentication realm.
  This parameter cannot be used with either `refresh_token` or `token`.
- **username** (string)
  The username of a user.
  This parameter cannot be used with either `refresh_token` or `token`.


## Responses
### 200


#### Body: application/json (object)
- **error_count** (number)
  The number of errors that were encountered when invalidating the tokens.
- **error_details** (array[object])
  Details about the errors.
  This field is not present in the response when `error_count` is `0`.
- **invalidated_tokens** (number)
  The number of the tokens that were invalidated as part of this request.
- **previously_invalidated_tokens** (number)
  The number of tokens that were already invalidated.


[Powered by Bump.sh](https://bump.sh)