Delete OAuth client

Overview

Revoke every token issued for the client and delete it. Safe to repeat — an already-revoked/missing client returns Already deleted!. Returns 403 unless the caller is the creator. Emits audit OAUTH_CLIENT_DELETED (SUCCESS or DENIED).

Prerequisites

• A bearer token in the Authorization header.

Base URL

Endpoint

POST /api/v1/sso/delete/client

Authentication

• Requires a bearer token in the Authorization: Bearer <bearer-token> header.

• bearer token. Owner-scoped.

Rate limit

• No rate limit.

Request body

{
  "client_id": "<ssoClientId>"
}

How it works

• 200 Successfully deleted! on delete, or Already deleted! when already revoked. 403 if not owner. 422 if client_id invalid.

Response

200 OK · 200

{
  "data": {
    "status": "success",
    "message": "Successfully deleted!"
  }
}

200 Already deleted · 200

{
  "data": {
    "status": "success",
    "message": "Already deleted!"
  }
}

403 Forbidden (not owner) · 403

{
  "message": "Forbidden",
  "status": "error",
  "errors": "Permission denied! The creator has the ability to delete."
}

422 Validation error · 422

{
  "message": "The selected client id is invalid.",
  "errors": {
    "client_id": [
      "The selected client id is invalid."
    ]
  }
}

Errors

Example request

curl --request POST \
  --url "https://production-api.shoutaboutus.com/api/v1/sso/delete/client" \
  --header 'Authorization: Bearer <bearer-token>' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"client_id": "<ssoClientId>"}'