Revoke an offboarded Okta user's active sessions and OAuth access and refresh tokens, and verify reauthentication is actually forced

Documented steps

1. Authenticate with scope okta.users.manage.
2. Close the front door first: deactivate or suspend the account via the Users lifecycle API so no new session can be established, in addition to revoking existing ones. Revocation alone does not prevent a fresh sign-in.
3. Revoke sessions and issued tokens in one call: DELETE /api/v1/users/{userId}/sessions?oauthTokens=true&forgetDevices=true.
4. Set oauthTokens=true explicitly - it defaults to false, and without it you kill only the Okta session while already-issued OpenID Connect and OAuth access and refresh tokens remain usable.
5. Note forgetDevices defaults to true, which clears remembered MFA factors and device trust for that user. Set it to false for routine session hygiene where you do not want to force MFA re-enrollment.
6. Expect 204 No Content on success; handle 403 (insufficient permission), 404 (user not found) and 429 (rate limited).
7. To revoke one specific token value already in hand, for example after a leaked credential: POST /oauth2/v1/revoke with Content-Type: application/x-www-form-urlencoded, the app's configured client authentication (for example Authorization: Basic base64(client_id:client_secret)), and body token={value}&token_type_hint=refresh_token or access_token.
8. Revoke the refresh token, not just the access token: revoking a refresh_token also revokes its associated access token, whereas revoking only an access_token leaves the refresh token able to mint a replacement.
9. Do not treat a 200 OK from /oauth2/v1/revoke as proof a live token was destroyed - per the OAuth spec, revoking an invalid, expired or already-revoked token also returns 200 so that token validity is not leaked.
10. Verify by attempting to use the prior session or token against a protected resource such as /oauth2/v1/userinfo or /api/v1/users/me and confirming it now fails, and by checking the System Log for the revocation events.
11. For bulk offboarding, pace the loop against the rate-limit headers and implement backoff on 429 rather than firing revocations concurrently.
12. Official docs consulted: https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserSessions/ | https://developer.okta.com/docs/guides/revoke-tokens/main/ | https://developer.okta.com/docs/guides/delete-all-stay-signed-in-sessions/main/ | https://developer.okta.com/docs/api/oauth2/