diff --git a/src/main/java/com/authlete/common/dto/TokenRevokeRequest.java b/src/main/java/com/authlete/common/dto/TokenRevokeRequest.java index a5ed98fde..90303484b 100644 --- a/src/main/java/com/authlete/common/dto/TokenRevokeRequest.java +++ b/src/main/java/com/authlete/common/dto/TokenRevokeRequest.java @@ -79,6 +79,14 @@ * the API returns {@code 400 Bad Request}. *
* + * + *+ * Bulk revocation with {@code clientIdentifier} only, {@code clientIdentifier} + {@code subject}, + * or {@code subject} only deletes at most 20 tokens per request + * (the default of {@code token.revoke.count.max} in {@code ServerConfiguration.java}). If the + * target has more than 20 tokens, the response {@code count} will be 20 and the remainder + * is left untouched. To fully wipe them, call the endpoint repeatedly until {@code count} returns 0. + *
* * @since 3.26 * @since Authlete 2.2.29 diff --git a/src/main/java/com/authlete/common/dto/TokenRevokeResponse.java b/src/main/java/com/authlete/common/dto/TokenRevokeResponse.java index 3286520b2..2b16591fb 100644 --- a/src/main/java/com/authlete/common/dto/TokenRevokeResponse.java +++ b/src/main/java/com/authlete/common/dto/TokenRevokeResponse.java @@ -26,12 +26,19 @@ public class TokenRevokeResponse extends ApiResponse { private static final long serialVersionUID = 1L; - + /** + * The maximum amount of tokens that can be revoked per request is 20. + * If 20 is returned then additional token revocation requests should be made until this value + * is 0 to ensure that all tokens are revoked. + */ private int count; /** * Get the number of revoked tokens. + * The maximum amount of tokens that can be revoked per request is 20. + * If 20 is returned then additional token revocation requests should be made until this value + * is 0 to ensure that all tokens are revoked. * * @return * The number of revoked tokens. @@ -44,6 +51,9 @@ public int getCount() /** * Set the number of revoked tokens. + * The maximum amount of tokens that can be revoked per request is 20. + * If 20 is returned then additional token revocation requests should be made until this value + * is 0 to ensure that all tokens are revoked. * * @param count * The number of revoked tokens.