{
  "slug": "vault-token-auth-adds-oauth-jwt-revocation-routes-and-a-global-denylist-49bfd93550b3",
  "title": "Vault token auth adds OAuth JWT revocation routes and a global denylist",
  "tools": [
    "vault"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-15T16:17:18.000Z",
  "announced_at": "2026-10-15T16:17:18.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When revoking an OAuth JWT, POST its issuer, configured unique ID claim, and denylist duration to `/auth/token/revoke-oauth`. For a Vault token, POST its accessor to `/auth/token/revoke-accessor`.",
    "examples": [
      "curl --header \"X-Vault-Token: <vault-token>\" --request POST --data '{\"issuer\":\"<jwt-iss>\",\"unique_id\":\"<configured-unique-id>\",\"exp\":3600}' http://127.0.0.1:8200/v1/auth/token/revoke-oauth",
      "curl --header \"X-Vault-Token: <vault-token>\" --request POST --data '{\"accessor\":\"<token-accessor>\"}' http://127.0.0.1:8200/v1/auth/token/revoke-accessor"
    ],
    "gotchas": [
      "Version: v2.2.0",
      "revoke-oauth.issuer (required): JWT `iss` claim identifying the OAuth issuer.",
      "revoke-oauth.unique_id (required): JWT claim value configured as `unique_id_claim` on the OAuth resource server profile.",
      "revoke-oauth.exp (required): Seconds to keep the JWT on Vault's denylist when the full JWT is not stored; actual JWT `exp` overrides this after the token is discovered.",
      "revoke-accessor.accessor (required): Accessor of the token to revoke.",
      "Prerequisite: The `revoke-oauth` endpoint is Enterprise.",
      "Prerequisite: Requests use a Vault token in the `X-Vault-Token` header or `Authorization: Bearer <token>` header.",
      "The global denylist applies across all namespaces.",
      "The `revoke-oauth` endpoint identifies an external token by issuer and unique ID."
    ]
  },
  "why_it_matters": "Revoke an OAuth JWT so it cannot be authorized across Vault namespaces.",
  "sources": [
    "https://github.com/hashicorp/vault/releases/tag/v2.2.0",
    "https://developer.hashicorp.com/vault/api-docs/auth/token",
    "https://developer.hashicorp.com/vault/docs/auth/token"
  ],
  "rank": 0.91026,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "daily-20261017-12",
    "verdict_id": "daily-20261017-12:daily-20261017-12-035d2bf2c0c6833b-6:gate",
    "evidence_hash": "e75d7096213b26a08e017e0be3dc58b0c509c6fd18db4283550cdc0f367f5dd9"
  },
  "review": {
    "draft_hash": "863fefed0443a7f180e9abf6832253476b00744088a404e92c99a3bea6501fe3",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-15T16:17:18.000Z",
    "decision": "daily-20261017-12:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.91 >= 0.9; 2 needed) and Jev gave 0.65 (>= 0.6 needed)."
  }
}