# Token revoked

**Event:** `token.revoked`

## Description

Fires when an OAuth access token belonging to your app is revoked by any
path: the user, an admin, your own `token.revoke` call, or SCIM user
deactivation.

**Event name:** `token.revoked`

Delivered inside the standard [event envelope](/docs/webhooks/webhooks#event-envelope);
the schema below shows the full delivery body with this event's payload
under `data`.

Delivery is authenticated by your webhook signing secret — not by the
revoked token — so you still receive this event after the grant is gone.
You may also receive it for a token you no longer hold (for example after
calling `token.revoke` yourself); treat handling as idempotent.

This event does **not** mean the app was uninstalled. Webhook subscriptions
and other users' tokens are untouched unless a separate uninstall path
also runs. See [`app.uninstalled`](/docs/webhooks/app-uninstalled).

**Required scope:** `webhook:write` (the same scope needed to subscribe).

## Webhook Payload


### Example Payload

```json
{
  "type": "token.revoked",
  "eventId": "0197f9b0-1a2b-7cc3-9d0e-1f2a3b4c5d6e",
  "timestamp": "2026-07-20T18:00:00.000000Z",
  "apiVersion": "2026-07-07",
  "data": {
    "clientId": "9f3c2a1b0e8d7c6b5a49382716150493",
    "personId": 12345,
    "reason": "user_revoked"
  }
}
```

---

*Machine-readable API documentation.*
*Full documentation: https://developer.ro.am/docs/webhooks/token-revoked*