From 71a1f38beceb3bfca9c1147b0de23e143cd265eb Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Wed, 19 Aug 2026 16:58:47 +0300 Subject: [PATCH 1/7] chore(other): update docs with refresh token grant type --- openapi/cafe.yaml | 7 ++++- openapi/components/schemas/OAuth2Client.yaml | 1 + .../schemas/RegisterClientObject.yaml | 3 +- openapi/paths/oauth2_register.yaml | 30 +++++++++++++------ 4 files changed, 30 insertions(+), 11 deletions(-) diff --git a/openapi/cafe.yaml b/openapi/cafe.yaml index d127374..a9a9099 100644 --- a/openapi/cafe.yaml +++ b/openapi/cafe.yaml @@ -48,11 +48,16 @@ components: securitySchemes: OAuth2: type: oauth2 - description: OAuth2 authorization for API access. + description: | + OAuth2 authorization for API access. + + The token endpoint also accepts `grant_type=refresh_token` to exchange a refresh token for a new access token without user interaction. + Refresh tokens are issued by the authorization code flow for clients registered with the `refresh_token` grant type. flows: authorizationCode: authorizationUrl: https://api.cafe.redocly.com/oauth2/authorize tokenUrl: https://api.cafe.redocly.com/oauth2/token + refreshUrl: https://api.cafe.redocly.com/oauth2/token scopes: menu:read: Read access to menu items and images menu:write: Write access to menu items (create, delete) diff --git a/openapi/components/schemas/OAuth2Client.yaml b/openapi/components/schemas/OAuth2Client.yaml index dd98342..3ed515d 100644 --- a/openapi/components/schemas/OAuth2Client.yaml +++ b/openapi/components/schemas/OAuth2Client.yaml @@ -49,6 +49,7 @@ properties: enum: - authorization_code - client_credentials + - refresh_token description: List of grant types (registered metadata). required: - clientId diff --git a/openapi/components/schemas/RegisterClientObject.yaml b/openapi/components/schemas/RegisterClientObject.yaml index 070fcd4..f3c7483 100644 --- a/openapi/components/schemas/RegisterClientObject.yaml +++ b/openapi/components/schemas/RegisterClientObject.yaml @@ -27,6 +27,7 @@ properties: enum: - authorization_code - client_credentials - description: List of grant types. + - refresh_token + description: List of grant types. Include `refresh_token` alongside `authorization_code` to let the client exchange refresh tokens for new access tokens. required: - name diff --git a/openapi/paths/oauth2_register.yaml b/openapi/paths/oauth2_register.yaml index ab8eae0..1315195 100644 --- a/openapi/paths/oauth2_register.yaml +++ b/openapi/paths/oauth2_register.yaml @@ -2,18 +2,18 @@ post: tags: - Authorization summary: Create OAuth2 client - description: > - Register a new OAuth2 client for dynamic client registration. + description: | + Register a new OAuth2 client for dynamic client registration. This endpoint implements the Dynamic Client Registration Protocol (RFC 7591), using camelCase field names instead of the RFC's snake_case convention (e.g., `redirectUris` instead of `redirect_uris`, `grantTypes` instead of `grant_types`). The `name` field is required. Other fields are optional. If not provided: - - `redirectUris` defaults to an empty array. Note: When using the - `authorization_code` grant type, - `redirectUris` must be provided (per RFC 7591 Section 2). - - `scopes` defaults to all available scopes (menu:read, menu:write, - orders:read, orders:write) - - `grantTypes` defaults to both supported grant types (authorization_code, - client_credentials) + - `redirectUris` defaults to an empty array. Note: When using the `authorization_code` grant type, `redirectUris` must be provided (per RFC 7591 Section 2). + - `scopes` defaults to all available scopes (menu:read, menu:write, orders:read, orders:write) + - `grantTypes` defaults to `authorization_code` and `client_credentials` + + The `refresh_token` grant type is also supported, but it is not included in the default. + Request it explicitly in `grantTypes` for the token endpoint to accept `grant_type=refresh_token` from this client. + Refresh tokens are only issued by the `authorization_code` flow, so register `refresh_token` together with `authorization_code` (and a valid `redirectUris` entry). Returns the registered client information per RFC 7591, including: @@ -42,6 +42,18 @@ post: - revenue:read grantTypes: - client_credentials + RegisterClientWithRefreshToken: + dataValue: + name: pos-terminal + redirectUris: + - https://api.cafe.redocly.com/callback + scopes: + - menu:read + - orders:read + - orders:write + grantTypes: + - authorization_code + - refresh_token responses: '201': description: OAuth2 client registered successfully. From 1667e9f61c4baf274414bb1211ea803f94015244 Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Thu, 20 Aug 2026 09:56:46 +0300 Subject: [PATCH 2/7] chore(other): changes after review --- openapi/paths/oauth2_register.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openapi/paths/oauth2_register.yaml b/openapi/paths/oauth2_register.yaml index 1315195..38f5d7f 100644 --- a/openapi/paths/oauth2_register.yaml +++ b/openapi/paths/oauth2_register.yaml @@ -8,7 +8,7 @@ post: The `name` field is required. Other fields are optional. If not provided: - `redirectUris` defaults to an empty array. Note: When using the `authorization_code` grant type, `redirectUris` must be provided (per RFC 7591 Section 2). - - `scopes` defaults to all available scopes (menu:read, menu:write, orders:read, orders:write) + - `scopes` defaults to all available scopes (menu:read, menu:write, orders:read, orders:write, revenue:read) - `grantTypes` defaults to `authorization_code` and `client_credentials` The `refresh_token` grant type is also supported, but it is not included in the default. From 5a17930d5d28dc20b3acd806080e659bee7b5f14 Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Thu, 20 Aug 2026 11:44:58 +0300 Subject: [PATCH 3/7] chore(other): changes after review --- openapi/components/schemas/RegisterClientObject.yaml | 10 ++++++++++ openapi/paths/oauth2_register.yaml | 2 -- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/openapi/components/schemas/RegisterClientObject.yaml b/openapi/components/schemas/RegisterClientObject.yaml index f3c7483..d88ad67 100644 --- a/openapi/components/schemas/RegisterClientObject.yaml +++ b/openapi/components/schemas/RegisterClientObject.yaml @@ -8,6 +8,7 @@ properties: items: type: string format: uri + default: [] description: List of redirect URIs (optional, defaults to empty array). scopes: type: array @@ -19,6 +20,12 @@ properties: - orders:read - orders:write - revenue:read + default: + - menu:read + - menu:write + - orders:read + - orders:write + - revenue:read description: List of scopes. grantTypes: type: array @@ -28,6 +35,9 @@ properties: - authorization_code - client_credentials - refresh_token + default: + - authorization_code + - client_credentials description: List of grant types. Include `refresh_token` alongside `authorization_code` to let the client exchange refresh tokens for new access tokens. required: - name diff --git a/openapi/paths/oauth2_register.yaml b/openapi/paths/oauth2_register.yaml index 38f5d7f..ffb315c 100644 --- a/openapi/paths/oauth2_register.yaml +++ b/openapi/paths/oauth2_register.yaml @@ -32,8 +32,6 @@ post: RegisterClientObject: dataValue: name: auth - redirectUris: - - https://api.cafe.redocly.com/callback scopes: - menu:read - menu:write From 46ab4e2a6027e5d631a7febf046f9e5be614b15c Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Thu, 20 Aug 2026 12:16:55 +0300 Subject: [PATCH 4/7] chore(other): changes after review --- openapi/paths/oauth2_register.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/openapi/paths/oauth2_register.yaml b/openapi/paths/oauth2_register.yaml index ffb315c..c14de82 100644 --- a/openapi/paths/oauth2_register.yaml +++ b/openapi/paths/oauth2_register.yaml @@ -11,6 +11,9 @@ post: - `scopes` defaults to all available scopes (menu:read, menu:write, orders:read, orders:write, revenue:read) - `grantTypes` defaults to `authorization_code` and `client_credentials` + These defaults interact: a request that supplies only `name` pairs `authorization_code` with an empty `redirectUris`, which is not a usable combination. + Supply `redirectUris` explicitly to register the `authorization_code` grant, or set `grantTypes` to `client_credentials` alone for a client that needs no redirect URI. + The `refresh_token` grant type is also supported, but it is not included in the default. Request it explicitly in `grantTypes` for the token endpoint to accept `grant_type=refresh_token` from this client. Refresh tokens are only issued by the `authorization_code` flow, so register `refresh_token` together with `authorization_code` (and a valid `redirectUris` entry). From e7bad1b4f50afe3b95a2659b72ed8b8a4b29bb18 Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Thu, 20 Aug 2026 12:42:27 +0300 Subject: [PATCH 5/7] chore(other): update docs --- openapi/cafe.yaml | 3 ++- openapi/components/schemas/OAuth2Client.yaml | 1 - openapi/components/schemas/RegisterClientObject.yaml | 3 +-- openapi/paths/oauth2_register.yaml | 9 ++++----- 4 files changed, 7 insertions(+), 9 deletions(-) diff --git a/openapi/cafe.yaml b/openapi/cafe.yaml index a9a9099..13b7c23 100644 --- a/openapi/cafe.yaml +++ b/openapi/cafe.yaml @@ -52,7 +52,8 @@ components: OAuth2 authorization for API access. The token endpoint also accepts `grant_type=refresh_token` to exchange a refresh token for a new access token without user interaction. - Refresh tokens are issued by the authorization code flow for clients registered with the `refresh_token` grant type. + The authorization code flow returns a refresh token with every access token; the client credentials flow returns none. + Each refresh is rotated: the presented refresh token is retired and a replacement is returned, so a client must store the new value and stop using the old one. Refresh tokens expire 30 days after they are issued. flows: authorizationCode: authorizationUrl: https://api.cafe.redocly.com/oauth2/authorize diff --git a/openapi/components/schemas/OAuth2Client.yaml b/openapi/components/schemas/OAuth2Client.yaml index 3ed515d..dd98342 100644 --- a/openapi/components/schemas/OAuth2Client.yaml +++ b/openapi/components/schemas/OAuth2Client.yaml @@ -49,7 +49,6 @@ properties: enum: - authorization_code - client_credentials - - refresh_token description: List of grant types (registered metadata). required: - clientId diff --git a/openapi/components/schemas/RegisterClientObject.yaml b/openapi/components/schemas/RegisterClientObject.yaml index d88ad67..d95876d 100644 --- a/openapi/components/schemas/RegisterClientObject.yaml +++ b/openapi/components/schemas/RegisterClientObject.yaml @@ -34,10 +34,9 @@ properties: enum: - authorization_code - client_credentials - - refresh_token default: - authorization_code - client_credentials - description: List of grant types. Include `refresh_token` alongside `authorization_code` to let the client exchange refresh tokens for new access tokens. + description: List of grant types. `refresh_token` is not registrable; any client holding a refresh token may present it at the token endpoint. required: - name diff --git a/openapi/paths/oauth2_register.yaml b/openapi/paths/oauth2_register.yaml index c14de82..4831f3b 100644 --- a/openapi/paths/oauth2_register.yaml +++ b/openapi/paths/oauth2_register.yaml @@ -14,9 +14,9 @@ post: These defaults interact: a request that supplies only `name` pairs `authorization_code` with an empty `redirectUris`, which is not a usable combination. Supply `redirectUris` explicitly to register the `authorization_code` grant, or set `grantTypes` to `client_credentials` alone for a client that needs no redirect URI. - The `refresh_token` grant type is also supported, but it is not included in the default. - Request it explicitly in `grantTypes` for the token endpoint to accept `grant_type=refresh_token` from this client. - Refresh tokens are only issued by the `authorization_code` flow, so register `refresh_token` together with `authorization_code` (and a valid `redirectUris` entry). + Refresh tokens require no registration and `refresh_token` is not a value you can register in `grantTypes`. + The token endpoint returns a refresh token alongside every access token it issues for the `authorization_code` grant, and accepts `grant_type=refresh_token` from any client presenting a refresh token issued to it. + The `client_credentials` grant returns no refresh token (RFC 6749 Section 4.4.3); those clients request a new access token with their own credentials instead. Returns the registered client information per RFC 7591, including: @@ -43,7 +43,7 @@ post: - revenue:read grantTypes: - client_credentials - RegisterClientWithRefreshToken: + RegisterClientForAuthorizationCode: dataValue: name: pos-terminal redirectUris: @@ -54,7 +54,6 @@ post: - orders:write grantTypes: - authorization_code - - refresh_token responses: '201': description: OAuth2 client registered successfully. From ed192994630cc0772495596e542a5f6546dc016d Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Thu, 20 Aug 2026 13:11:58 +0300 Subject: [PATCH 6/7] chore(other): document revoke endpoint --- openapi/cafe.yaml | 20 ++++++++--- .../schemas/RevokeTokenRequest.yaml | 23 ++++++++++++ openapi/paths/oauth2_register.yaml | 2 -- openapi/paths/oauth2_revoke.yaml | 36 +++++++++++++++++++ redocly.yaml | 2 +- 5 files changed, 76 insertions(+), 7 deletions(-) create mode 100644 openapi/components/schemas/RevokeTokenRequest.yaml create mode 100644 openapi/paths/oauth2_revoke.yaml diff --git a/openapi/cafe.yaml b/openapi/cafe.yaml index 13b7c23..63b03f2 100644 --- a/openapi/cafe.yaml +++ b/openapi/cafe.yaml @@ -41,6 +41,8 @@ paths: $ref: paths/revenue.yaml /oauth2/register: $ref: paths/oauth2_register.yaml + /oauth2/revoke: + $ref: paths/oauth2_revoke.yaml webhooks: order-notification: $ref: webhooks/order-notification.yaml @@ -49,11 +51,21 @@ components: OAuth2: type: oauth2 description: | - OAuth2 authorization for API access. + OAuth2 authorization for API access. The token endpoint accepts `grant_type=authorization_code`, `grant_type=client_credentials`, and `grant_type=refresh_token`. Issued tokens can be revoked through `POST /oauth2/revoke`. - The token endpoint also accepts `grant_type=refresh_token` to exchange a refresh token for a new access token without user interaction. - The authorization code flow returns a refresh token with every access token; the client credentials flow returns none. - Each refresh is rotated: the presented refresh token is retired and a replacement is returned, so a client must store the new value and stop using the old one. Refresh tokens expire 30 days after they are issued. + ### Differences from the OAuth2 specifications + + A standard OAuth2 client library can drive these flows, with the following to account for. + + Two behaviors do not conform to the specifications: + + - **Errors use RFC 9457 problem+json, not RFC 6749 Section 5.2.** Failures return `application/problem+json` with `type`, `title`, `status`, and `instance`. There is no `error` or `error_description` field, so the standard codes (`invalid_grant`, `invalid_client`, `unsupported_grant_type`) never appear — branch on the HTTP status and `title` instead. A refresh token that is expired, already rotated, or unrecognized returns `400` with a `title` of `Refresh token has expired` or `Invalid refresh token`, where a conformant server would return `error: invalid_grant`. + - **`refresh_token` is not a registrable grant type.** RFC 7591 Section 2 lists it, but `/oauth2/register` accepts only `authorization_code` and `client_credentials` in `grantTypes`. Refreshing requires no registration: holding a refresh token issued to the client is the authorization. + + Two are choices the specifications leave to the server: + + - **Refresh tokens rotate on every use.** A successful refresh retires the token presented and returns a replacement in `refresh_token`, as RFC 6749 Section 6 permits and the OAuth2 Security Best Current Practice recommends. Store the new value; the old one stops working. Refresh tokens expire 30 days after they are issued, and rotation restarts that window. The authorization code flow returns a refresh token with every access token; the client credentials flow returns none (RFC 6749 Section 4.4.3). + - **`scope` accepts commas.** The space-delimited form required by RFC 6749 is always accepted and recommended; comma-separated values are additionally tolerated. flows: authorizationCode: authorizationUrl: https://api.cafe.redocly.com/oauth2/authorize diff --git a/openapi/components/schemas/RevokeTokenRequest.yaml b/openapi/components/schemas/RevokeTokenRequest.yaml new file mode 100644 index 0000000..d826159 --- /dev/null +++ b/openapi/components/schemas/RevokeTokenRequest.yaml @@ -0,0 +1,23 @@ +type: object +description: > + OAuth2 token revocation request (RFC 7009). Sent as `application/x-www-form-urlencoded` with the RFC's snake_case field names, unlike the camelCase used by the client registration endpoint. +properties: + token: + type: string + description: The access token or refresh token to revoke. + token_type_hint: + type: string + enum: + - access_token + - refresh_token + description: Hint about the type of the submitted token. Both token types are searched regardless of the hint, so this is an optimization only (RFC 7009 Section 2.1). + client_id: + type: string + description: Identifier of the client the token was issued to. + client_secret: + type: string + description: Secret of the client the token was issued to. +required: + - token + - client_id + - client_secret diff --git a/openapi/paths/oauth2_register.yaml b/openapi/paths/oauth2_register.yaml index 4831f3b..1e00427 100644 --- a/openapi/paths/oauth2_register.yaml +++ b/openapi/paths/oauth2_register.yaml @@ -63,7 +63,5 @@ post: $ref: ../components/schemas/OAuth2Client.yaml '400': $ref: ../components/responses/BadRequest.yaml - '401': - $ref: ../components/responses/Unauthorized.yaml '500': $ref: ../components/responses/InternalServerError.yaml diff --git a/openapi/paths/oauth2_revoke.yaml b/openapi/paths/oauth2_revoke.yaml new file mode 100644 index 0000000..35a6fa2 --- /dev/null +++ b/openapi/paths/oauth2_revoke.yaml @@ -0,0 +1,36 @@ +post: + tags: + - Authorization + summary: Revoke OAuth2 token + description: | + Revoke an access token or a refresh token, per the OAuth2 Token Revocation protocol (RFC 7009). + + Requires client authentication: send the `client_id` and `client_secret` of the client the token was issued to. Credentials go in the form body rather than an `Authorization` header. + + An access token and the refresh token issued alongside it share one record, so revoking either also revokes its counterpart. To end a session, revoking the refresh token is enough. + + Revoking a token that is unknown, already revoked, or issued to a different client returns `200` (RFC 7009 Section 2.2), so the endpoint cannot be used to probe which tokens are valid. + operationId: revokeOAuth2Token + security: [] + requestBody: + required: true + content: + application/x-www-form-urlencoded: + schema: + $ref: ../components/schemas/RevokeTokenRequest.yaml + examples: + RevokeRefreshToken: + dataValue: + token: 4f3c1d9a8b7e6f5a4c3b2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a + token_type_hint: refresh_token + client_id: cafe_client_01h1s5z6vf2mm1mz3hevnn9va7 + client_secret: cafe_secret_9f8e7d6c5b4a39281706f5e4d3c2b1a0 + responses: + '200': + description: The token was revoked, or no matching token existed. + '400': + $ref: ../components/responses/BadRequest.yaml + '401': + $ref: ../components/responses/Unauthorized.yaml + '500': + $ref: ../components/responses/InternalServerError.yaml diff --git a/redocly.yaml b/redocly.yaml index da0e796..b93e064 100644 --- a/redocly.yaml +++ b/redocly.yaml @@ -14,7 +14,7 @@ apis: assertions: defined: true assertions: - pattern: /^(Create|Get|Retrieve|Replace|Update|Delete|Login|Send|Callback|Cancel|List|Partially update).*[^\.]$/ + pattern: /^(Create|Get|Retrieve|Replace|Update|Delete|Login|Send|Callback|Cancel|Revoke|List|Partially update).*[^\.]$/ logo: srcSet: "./images/cafe-logo-black.svg light, ./images/cafe-logo-white.svg dark" From 115816d12d20d3219747c68baf02f868cc3e8582 Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Thu, 20 Aug 2026 13:36:50 +0300 Subject: [PATCH 7/7] chore: revert revoke endpoint documentation --- openapi/cafe.yaml | 6 ++-- .../schemas/RevokeTokenRequest.yaml | 23 ------------ openapi/paths/oauth2_revoke.yaml | 36 ------------------- redocly.yaml | 2 +- 4 files changed, 3 insertions(+), 64 deletions(-) delete mode 100644 openapi/components/schemas/RevokeTokenRequest.yaml delete mode 100644 openapi/paths/oauth2_revoke.yaml diff --git a/openapi/cafe.yaml b/openapi/cafe.yaml index 63b03f2..a43275d 100644 --- a/openapi/cafe.yaml +++ b/openapi/cafe.yaml @@ -41,8 +41,6 @@ paths: $ref: paths/revenue.yaml /oauth2/register: $ref: paths/oauth2_register.yaml - /oauth2/revoke: - $ref: paths/oauth2_revoke.yaml webhooks: order-notification: $ref: webhooks/order-notification.yaml @@ -51,7 +49,7 @@ components: OAuth2: type: oauth2 description: | - OAuth2 authorization for API access. The token endpoint accepts `grant_type=authorization_code`, `grant_type=client_credentials`, and `grant_type=refresh_token`. Issued tokens can be revoked through `POST /oauth2/revoke`. + OAuth2 authorization for API access. The token endpoint accepts `grant_type=authorization_code`, `grant_type=client_credentials`, and `grant_type=refresh_token`. ### Differences from the OAuth2 specifications @@ -60,7 +58,7 @@ components: Two behaviors do not conform to the specifications: - **Errors use RFC 9457 problem+json, not RFC 6749 Section 5.2.** Failures return `application/problem+json` with `type`, `title`, `status`, and `instance`. There is no `error` or `error_description` field, so the standard codes (`invalid_grant`, `invalid_client`, `unsupported_grant_type`) never appear — branch on the HTTP status and `title` instead. A refresh token that is expired, already rotated, or unrecognized returns `400` with a `title` of `Refresh token has expired` or `Invalid refresh token`, where a conformant server would return `error: invalid_grant`. - - **`refresh_token` is not a registrable grant type.** RFC 7591 Section 2 lists it, but `/oauth2/register` accepts only `authorization_code` and `client_credentials` in `grantTypes`. Refreshing requires no registration: holding a refresh token issued to the client is the authorization. + - **`refresh_token` is not a registrable grant type.** RFC 7591 Section 2 lists it, but `/oauth2/register` accepts only `authorization_code` and `client_credentials` in `grantTypes`. Refreshing requires no registration: holding a refresh token issued to the client is the authorization. A consequence is that refresh capability cannot be disabled per client — every `authorization_code` grant returns a refresh token, so a client intended for a shared or public device cannot be registered without one. Two are choices the specifications leave to the server: diff --git a/openapi/components/schemas/RevokeTokenRequest.yaml b/openapi/components/schemas/RevokeTokenRequest.yaml deleted file mode 100644 index d826159..0000000 --- a/openapi/components/schemas/RevokeTokenRequest.yaml +++ /dev/null @@ -1,23 +0,0 @@ -type: object -description: > - OAuth2 token revocation request (RFC 7009). Sent as `application/x-www-form-urlencoded` with the RFC's snake_case field names, unlike the camelCase used by the client registration endpoint. -properties: - token: - type: string - description: The access token or refresh token to revoke. - token_type_hint: - type: string - enum: - - access_token - - refresh_token - description: Hint about the type of the submitted token. Both token types are searched regardless of the hint, so this is an optimization only (RFC 7009 Section 2.1). - client_id: - type: string - description: Identifier of the client the token was issued to. - client_secret: - type: string - description: Secret of the client the token was issued to. -required: - - token - - client_id - - client_secret diff --git a/openapi/paths/oauth2_revoke.yaml b/openapi/paths/oauth2_revoke.yaml deleted file mode 100644 index 35a6fa2..0000000 --- a/openapi/paths/oauth2_revoke.yaml +++ /dev/null @@ -1,36 +0,0 @@ -post: - tags: - - Authorization - summary: Revoke OAuth2 token - description: | - Revoke an access token or a refresh token, per the OAuth2 Token Revocation protocol (RFC 7009). - - Requires client authentication: send the `client_id` and `client_secret` of the client the token was issued to. Credentials go in the form body rather than an `Authorization` header. - - An access token and the refresh token issued alongside it share one record, so revoking either also revokes its counterpart. To end a session, revoking the refresh token is enough. - - Revoking a token that is unknown, already revoked, or issued to a different client returns `200` (RFC 7009 Section 2.2), so the endpoint cannot be used to probe which tokens are valid. - operationId: revokeOAuth2Token - security: [] - requestBody: - required: true - content: - application/x-www-form-urlencoded: - schema: - $ref: ../components/schemas/RevokeTokenRequest.yaml - examples: - RevokeRefreshToken: - dataValue: - token: 4f3c1d9a8b7e6f5a4c3b2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a - token_type_hint: refresh_token - client_id: cafe_client_01h1s5z6vf2mm1mz3hevnn9va7 - client_secret: cafe_secret_9f8e7d6c5b4a39281706f5e4d3c2b1a0 - responses: - '200': - description: The token was revoked, or no matching token existed. - '400': - $ref: ../components/responses/BadRequest.yaml - '401': - $ref: ../components/responses/Unauthorized.yaml - '500': - $ref: ../components/responses/InternalServerError.yaml diff --git a/redocly.yaml b/redocly.yaml index b93e064..da0e796 100644 --- a/redocly.yaml +++ b/redocly.yaml @@ -14,7 +14,7 @@ apis: assertions: defined: true assertions: - pattern: /^(Create|Get|Retrieve|Replace|Update|Delete|Login|Send|Callback|Cancel|Revoke|List|Partially update).*[^\.]$/ + pattern: /^(Create|Get|Retrieve|Replace|Update|Delete|Login|Send|Callback|Cancel|List|Partially update).*[^\.]$/ logo: srcSet: "./images/cafe-logo-black.svg light, ./images/cafe-logo-white.svg dark"