Send Docs Feedback

Note: Most user interface tasks can be performed in Edge Classic or the New Edge experience. For an overview, getting started topics, and release notes specific to the New Edge experience, see the docs.

Delete OAuthV2 Info policy

  

What

Deletes the specified OAuth V2 authorization code or access token.

Alternatively, you can revoke and re-approve tokens, as described in Approving and revoking access tokens.

Where

This policy can be attached in the following locations. See the Samples for specific attachment guidance in different situations.

ProxyEndpoint TargetEndpoint
    PreFlow Flow PostFlow PreFlow Flow PostFlow    
Request    
    Response
    PostFlow Flow PreFlow PostFlow Flow PreFlow    

Samples

Below is an example policy used to delete an OAuth 2.0 access token. The example below locates the access token to delete on the request message by looking for a header called access_token.

<DeleteOAuthV2Info name="DeleteAccessToken">
     <AccessToken ref="request.header.access_token"></AccessToken>
</DeleteOAuthV2Info>

Below is an example policy used to delete an OAuth 2.0 authorization code. The example below locates the auth code to delete on the request message by looking for a query parameter called code.

<DeleteOAuthV2Info name="DeleteAuthCode">
     <AuthorizationCode ref="request.queryparam.code"></AuthorizationCode>
</DeleteOAuthV2Info>

Element Reference

The element reference describes the elements and attributes of the DeleteOAuthV2Info policy.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<DeleteOAuthV2Info async="false" continueOnError="false" enabled="true" name="DeleteOAuthV2Info-1">    
    <DisplayName>Delete OAuth v2.0 Info 1</DisplayName>
    <AccessToken ref={some-variable}></AccessToken>
    <!--<AuthorizationCode ref={some-variable}></AuthorizationCode>-->
    <Attributes/>
</DeleteOAuthV2Info

<DeleteOAuthV2Info> attributes

<DeleteOAuthV2Info async="false" continueOnError="false" enabled="true" name="Delete-OAuth-v20-Info-1">
Attribute Description Default Presence
async

Set to true to specify that the policy should be run in a thread pool different than the pool servicing the request/response flow. Default is false.

This setting is only used for for internal optimization.

false Optional
continueOnError

Most policies are expected to return an error when a failure occurs. By setting this attribute to true, Flow execution continues on failure.

false Optional
enabled Determines whether a policy is enforced or not. If set to false, a policy is 'turned off', and not enforced (even though the policy remains attached to a Flow). true Optional
name

The internal name of the policy. This name is referenced in Step elements to attach the policy to a Flow.

Note: Characters you can use in the name are restricted to: A-Z0-9._\-$ %. The Management UI enforces additional restrictions, such as automatically removing characters that are not alphanumeric.

N/A Required

<AccessToken> element

Identifies the variable where the access token to delete is located. For example, if the access token is attached to request message as a query parameter called "access_token", specify request.queryparam.access_token. You can use any valid variable that references the token. Or, could pass in the literal token string (rare case).

 <AccessToken ref="request.queryparam.access_token"></AccessToken>
Default: N/A
Presence: Either <AccessToken> or <AuthorizationCode> is required.
Type: String

Attributes

Attribute Description Default Presence
ref

An access token variable. Typically, retrieved from a flow variable. For example: request.header.token or request.queryparam.token.

N/A Optional

<AuthorizationCode> element

Identifies the variable where the authorization code to delete is located. For example, if the auth code is attached to request message as a query parameter called "code", specify request.queryparam.code. You can use any valid variable that references the token. Or, could pass in the literal token string (rare case).

 <AccessToken ref="request.queryparam.access_token"></AccessToken>
Default: N/A
Presence: Either <AccessToken> or <AuthorizationCode> is required.
Type: String

Attributes

Attribute Description Default Presence
ref

An access token variable. Typically, retrieved from a flow variable. For example: request.header.code or request.queryparam.code.

N/A Optional

<DisplayName> element

A natural-language name that labels the policy in the management UI proxy editor. If omitted, the policy name attribute is used.

<DisplayName>DeleteOAuthV2Info 1</DisplayName>
Default: The value of the policy's name attribute.
Presence: Optional
Type: String

Error reference

This section describes the error messages and flow variables that are set when this policy triggers an error. This information is important to know if you are developing fault rules for a proxy. To learn more, see What you need to know about policy errors and Fault handling.

Error code prefix

steps.oauth.v2 (What's this?)

Runtime errors

These errors can occur when the policy executes. The error names shown below are the strings that are assigned to the fault.name variable when an error occurs. See the Fault variables section below for more details.

Error name HTTP status Cause
invalid_access_token 500 The access token sent to the policy is invalid.
invalid_request-authorization_code_invalid 500 The authorization code sent to the policy is invalid.

Deployment errors

Refer to the message reported in the UI for information about deployment errors.

Fault variables

These variables are set when this policy triggers an error at runtime.

You an use these variables to create Fault Rule conditions. For more information, see What you need to know about policy errors.

Variables set (Learn more) Where Example
[prefix].[policy_name].failed The [prefix] is oauthV2.
The [policy_name] is the name of the policy that threw the error.
oauthV2.DeleteTokenInfo.failed = true
[prefix].[policy_name].fault.name The [prefix] is oauthV2.
The [policy_name] is the name of the policy that threw the error.

oauthV2.DeleteTokenInfo.fault.name = invalid_access_token

[prefix].[policy_name].fault.cause The [prefix] is oauthV2.
The [policy_name] is the name of the policy that threw the error.
oauthV2.DeleteTokenInfo.cause = Invalid Access Token
fault.name = [error_name] [error_name] is the specific error name to check for as listed in the table above. fault.name = "invalid_access_token"

Example error response

{
  "fault": {
    "faultstring": "Invalid Access Token",
    "detail": {
      "errorcode": "keymanagement.service.invalid_access_token"
    }
  }
}

Example fault rule

<FaultRule name="DeleteOAuthV2Info_Faults">
    <Step>
        <Name>AM-InvalidTokenResponse</Name>
    </Step>
    <Condition>(fault.name = "invalid_access_token")</Condition>
</FaultRule>

Schema

Each policy type is defined by an XML schema (.xsd). For reference, policy schemas are available on GitHub.

Related topics

Help or comments?