Question

Delete (revoke) OAuth token endpoint 404s

Forum|Forum|5 months ago
February 16, 2026
4 replies
67 views

Hello, I noticed that I can't seem to revoke/delete an oauth token via the API. I am using an authorization token with full access.

I try:

curl https://$ZENDESK_SUBDOMAIN.zendesk.com/api/v2/oauth/tokens.json -v -u $ZENDESK_EMAIL/token:$ZENDESK_API_TOKEN

And I get a page of results like

{"tokens":[{"url":"https://xyz.zendesk.com/api/v2/oauth/tokens/1234567890.json","id":1234567890,...

If I then do:

curl https://$ZENDESK_SUBDOMAIN.zendesk.com/api/v2/oauth/tokens/1234567890 -v -u $ZENDESK_EMAIL/token:$ZENDESK_API_TOKEN

I get

{"error":"RecordNotFound","description":"Not found"}

I tried using the OAuth Client page in the admin, found the token I was interested in by paging through lots of pages manually (you need a better UI on the Oauth Client > View Tokens page), but I found it, and tried to delete from there. It did not delete there, either, I also got a 404

I tried another token and was able to get it. I didn't want to actually delete it, so I just retreived it, but I did not get a 404 in that case.

I don't think it's a scope/permissions issue, surely I should be able to do this from the Zendesk admin. And as I said, the token being used to authorize the call should have full access. It was generated with the API Token toll in the admin, which doesn't even seem to have options for restrictions on scopes.

My only thought is that maybe this token is already revoked, and weirdly a “get several” call will include it, but a “get by single id” call will 404. Am I close? If at all, is there any way to tell that tokens returned by the page are revoked or not?

api

Greg K

Employee

Hi Dru,

This is an issue that I haven't run into before, so I have some questions to help me see what may be going on. Based on the information you provided, I'm almost 100% certain that you're doing this correctly, but I just want to clarify...when you're making the API calls to view and delete the tokens, you are using the id parameter and not the actual token itself, right? It seems like you are, this is just an area where I have found people running into issues before and want to make sure that's all good.

You mentioned that you were able to retrieve another token that you successfully deleted, which shouldn't be possible. Do you mean that you regenerated a new token? If not, could you provide some more details on how you retrieved this?

The next question is regarding the admin center 404 that you received. When you're looking at the OAuth tokens, is your user profile listed under "Created by" or is it another admin?

D

Dru11Author

Hi Greg, thanks for following up. Yes, I'm using the ID, not the token, like https://redacted.zendesk.com/api/v2/oauth/tokens/49252931287187.

When I said “I tried another token and was able to get it. I didn't want to actually delete it, so I just retrieved it, but I did not get a 404 in that case.” I meant that I have four tokens out of over 500 that, if I cal the GET endpoint with that ID, will not 404. The rest 404. I looped over all of them and only 4 did not receive a 404 in response. So I'm not sure my original theory is correct, because surely not 99% of our tokens are revoked?

I'm not sure I know how to answer your last question. Where do I find “Created by?” Is this something specific on the OAuth token page?

I can tell you that I'm an admin, and have the admin role for all of our products except Chat.

D

Dru11Author

Hello, @greg29 , I'm wondering if you have any further thoughts here?

Greg K

Employee

Hi Dru, apologies for the very lengthy delay! I wanted to check back in with you to see if you still needed assistance with this.

Sign up

Login with SSO

Login to the community

Login with SSO