DeleteOAuthV2Info policy

This pageapplies toApigee andApigee hybrid.

View Apigee Edge documentation.

The DeleteOAuthv2Info policy deletes the specified OAuth V2 authorization code or access token.

Note: Alternatively, you can revoke and re-approve tokens, as described inApproving and revoking access tokens.

This policy is anExtensible policy and use of this policy might have cost or utilization implications, depending on your Apigee license. For information on policy types and usage implications, seePolicy types.

Samples

Delete Access Token

Below is an example policy used to delete an OAuth 2.0 access token. The example below locates the access token to delete on the request message by looking for a header calledaccess_token.

<DeleteOAuthV2Info name="DeleteAccessToken">     <AccessToken ref="request.header.access_token"></AccessToken></DeleteOAuthV2Info>

Delete Auth Code

Below is an example policy used to delete an OAuth 2.0 authorization code. The example below locates the auth code to delete on the request message by looking for a query parameter calledcode.

<DeleteOAuthV2Info name="DeleteAuthCode">     <AuthorizationCode ref="request.queryparam.code"></AuthorizationCode></DeleteOAuthV2Info>

Element Reference

The element reference describes the elements and attributes of the DeleteOAuthV2Info policy.

<?xmlversion="1.0"encoding="UTF-8"standalone="yes"?><DeleteOAuthV2Infoasync="false"continueOnError="false"enabled="true"name="DeleteOAuthV2Info-1"><DisplayName>DeleteOAuthv2.0Info1</DisplayName><AccessTokenref={some-variable}></AccessToken><!--<AuthorizationCoderef={some-variable}></AuthorizationCode>--><Attributes/></DeleteOAuthV2Info

<DeleteOAuthV2Info> attributes

<DeleteOAuthV2Info async="false" continueOnError="false" enabled="true" name="Delete-OAuth-v20-Info-1">
AttributeDescriptionDefaultPresence
async

Set totrue to specify that the policy should be run in a thread pool different than the pool servicing the request/response flow. Default isfalse.

This setting is only used for internal optimization.

falseOptional
continueOnError

Most policies are expected to return an error when a failure occurs. By setting this attribute totrue, Flow execution continues on failure.

falseOptional
enabledDetermines whether a policy is enforced or not. If set tofalse, a policy is 'turned off', and not enforced (even though the policy remains attached to a Flow).trueOptional
name

The internal name of the policy. This name is referenced in Step elements to attach the policy to a Flow.

Note: Characters you can use in the name are restricted to:A-Z0-9._\-$ %. The Apigee UI enforces additional restrictions, such as automatically removing characters that are not alphanumeric.

N/ARequired

<AccessToken> element

Identifies the variable where the access token to delete is located. For example, if the access token is attached to request message as a query parameter called "access_token", specifyrequest.queryparam.access_token. You can use any valid variable that references the token. Or, could pass in the literal token string (rare case).

 <AccessToken ref="request.queryparam.access_token"></AccessToken>
Default:N/A
Presence:Either<AccessToken> or<AuthorizationCode> is required.
Type:String

Attributes

AttributeDescriptionDefaultPresence
ref

An access token variable. Typically, retrieved from a flow variable. For example:request.header.token orrequest.queryparam.token.

N/AOptional

<AuthorizationCode> element

Identifies the variable where the authorization code to delete is located. For example, if the auth code is attached to request message as a query parameter called "code", specifyrequest.queryparam.code. You can use any valid variable that references the token. Or, could pass in the literal token string (rare case).

 <AuthorizationCode ref="request.queryparam.code"></AuthorizationCode>
Default:N/A
Presence:Either<AccessToken> or<AuthorizationCode> is required.
Type:String

Attributes

AttributeDescriptionDefaultPresence
ref

An access token variable. Typically, retrieved from a flow variable. For example:request.header.code orrequest.queryparam.code.

N/AOptional

<DisplayName> element

A natural-language name that labels the policy in the Apigee UI proxy editor. If omitted, the policy name attribute is used.

<DisplayName>DeleteOAuthV2Info 1</DisplayName>
Default:The value of the policy'sname attribute.
Presence:Optional
Type:String

Error reference

This section describes the fault codes and error messages that are returned and fault variables that are set by Apigee when this policy triggers an error. This information is important to know if you are developing fault rules to handle faults. To learn more, seeWhat you need to know about policy errors andHandling faults.

Runtime errors

These errors can occur when the policy executes.

Fault codeHTTP statusCause
steps.oauth.v2.invalid_access_token401The access token sent to the policy is invalid.
steps.oauth.v2.invalid_request-authorization_code_invalid401The authorization code sent to the policy is invalid.
steps.oauth.v2.InvalidAPICallAsNoApiProductMatchFound401Please see Oauth2.0 Access Token Verification throws "Invalid API call as no apiproduct match found" error for information about troubleshooting this error.

Deployment errors

Refer to the message reported in the UI for information about deployment errors.

Fault variables

These variables are set when this policy triggers an error at runtime.

Note: You an use these variables to create Fault Rule conditions. For more information, seeWhat you need to know about policy errors.
VariablesWhereExample
fault.name="fault_name"fault_name is the name of the fault, as listed in theRuntime errors table above. The fault name is the last part of the fault code.fault.name = "invalid_access_token"
oauthV2.policy_name.failedpolicy_name is the user-specified name of the policy that threw the fault.oauthV2.DeleteTokenInfo.failed = true
oauthV2.policy_name.fault.namepolicy_name is the user-specified name of the policy that threw the fault.oauthV2.DeleteTokenInfo.fault.name = invalid_access_token
oauthv2.policy_name.fault.causepolicy_name is the user-specified name of the policy that threw the fault.oauthV2.DeleteTokenInfo.cause = Invalid Access Token

Example error response

{  "fault": {    "faultstring": "Invalid Access Token",    "detail": {      "errorcode": "keymanagement.service.invalid_access_token"    }  }}

Example fault rule

<faultrule name="VariableOfNonMsgType"></faultrule><FaultRule name="DeleteOAuthV2Info_Faults">    <Step>        <Name>AM-InvalidTokenResponse</Name>    </Step>    <Condition>(fault.name = "invalid_access_token")</Condition></FaultRule>

Schema

Each policy type is defined by an XML schema (.xsd). For reference,policy schemas are available on GitHub.

Related topics

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-17 UTC.