{ "schema": "varexis-index-free-publication-preview/1", "catalogue_version": "ice-04-tranche-60-v1", "route_id": "agentic_reviewed_auth0_refresh_revocation_grant_scope", "record_id": "VXI-EXT-ICE04-AUTH0-REFRESH-REVOCATION-GRANT-SCOPE-01-v1", "question": "Does unlinking one Auth0 device revoke every refresh token for the user and application?", "answer": "Auth0 distinguishes refresh-token revocation from deleting its authorization grant. The tenant revocation setting controls whether related tokens are invalidated with the grant; with the setting disabled, unlinking a device revokes its associated refresh token while leaving the grant intact. Verify the endpoint, setting and grant identity before claiming broader offboarding.", "records": [ { "record_id": "VXI-EXT-ICE04-AUTH0-REFRESH-REVOCATION-GRANT-SCOPE-01-v1", "url": "/varexis-index/records/auth0-refresh-revocation-grant-scope.json", "content_sha256": "d1b62b3fcb2b616545edd73427b9b558829c36394ce7c19a6e802d47935e264a", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-28T23:55:00.000Z", "record_id": "VXI-EXT-ICE04-AUTH0-REFRESH-REVOCATION-GRANT-SCOPE-01-v1", "record_kind": "external_reference", "title": "Auth0 token revocation and grant scope", "system": "Auth0", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does unlinking one Auth0 device revoke every refresh token for the user and application?", "near_questions": [ "Does Auth0 device unlinking delete the authorization grant?", "Which setting controls related refresh-token revocation?", "Can another device retain refresh access after unlinking one?", "What evidence supports complete Auth0 application offboarding?" ], "supported_claims": [ { "claim": "Auth0 distinguishes refresh-token revocation from deleting its authorization grant. The tenant revocation setting controls whether related tokens are invalidated with the grant; with the setting disabled, unlinking a device revokes its associated refresh token while leaving the grant intact. Verify the endpoint, setting and grant identity before claiming broader offboarding.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Do not infer all-device revocation or immediate expiry of existing access tokens from one device unlink.", "Buyer implementation, live runtime enforcement, settled payment, certification or permission to act are not established.", "No expanded capabilities or licences for existing INDEX executables." ], "public_summary": "Auth0 distinguishes refresh-token revocation from deleting its authorization grant. The tenant revocation setting controls whether related tokens are invalidated with the grant; with the setting disabled, unlinking a device revokes its associated refresh token while leaving the grant intact. Verify the endpoint, setting and grant identity before claiming broader offboarding.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "Auth0: Revoke Refresh Tokens", "source_url": "https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens.md", "checked_on": "2026-10-28", "candidate_record_id": "VXI-EXT-ICE04-AUTH0-REFRESH-REVOCATION-GRANT-SCOPE-01-v1", "candidate_record_sha256": "9b56c7f1c29c5a317ec4e123c0c59495add47c2d514b035dc3ad923d0839cc73", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Auth0 distinguishes refresh-token revocation from deleting its authorization grant. The tenant revocation setting controls whether related tokens are invalidated with the grant; with the setting disabled, unlinking a device revokes its associated refresh token while leaving the grant intact. Verify the endpoint, setting and grant identity before claiming broader offboarding.", "required_buyer_context": "Tenant revocation setting; Revocation endpoint and result; User, application, audience and grant identifiers; Remaining token and access-token lifecycle evidence. Buyer deployment not inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-28", "claim_to_check": "Does unlinking one Auth0 device revoke every refresh token for the user and application?", "documented_statement": { "status": "documented", "statement": "Auth0 distinguishes refresh-token revocation from deleting its authorization grant. The tenant revocation setting controls whether related tokens are invalidated with the grant; with the setting disabled, unlinking a device revokes its associated refresh token while leaving the grant intact. Verify the endpoint, setting and grant identity before claiming broader offboarding.", "source_ids": [ "auth0-revocation" ] }, "review_inference": { "status": "review_inference", "statement": "Review auth0 token revocation and grant scope before accepting the buyer claim. Administrative revocation scope depends on grant deletion settings, unlike automatic stale-token reuse detection. This is a documentation-review judgment, not an observed deployment outcome.", "source_ids": [ "auth0-revocation" ] }, "buyer_evidence_required": [ "Tenant revocation setting", "Revocation endpoint and result", "User, application, audience and grant identifiers", "Remaining token and access-token lifecycle evidence" ], "review_condition": { "status": "varexis_review_policy", "statement": "Do not infer all-device revocation or immediate expiry of existing access tokens from one device unlink." }, "unknowns": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected.", "unknown_finding": { "status": "unknown", "statement": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected." }, "evidence_sources": [ { "source_id": "auth0-revocation", "url": "https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens.md", "final_url": "https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens.md", "status": 200, "captured_at_utc": "2026-10-28T23:49:42.718849+00:00", "sha256": "eeb0f3f03b7db3b76bdff22751822f06c92f3e087e48de1b02a7f35fc20007c3", "bytes": 7773, "content_type": "text/markdown; charset=utf-8", "title": "Auth0: Revoke Refresh Tokens", "hash_basis": "SHA-256 of captured HTTP response body bytes", "checked_on": "2026-10-28", "capture_status": 200, "claim_review_completed": true, "reviewed_sections": [ "Choose whether token revocation deletes grants", "Considerations and limitations" ], "version_context": "Rolling official documentation captured 2026-10-28; exact response hash is pinned, not a stable vendor release. Verify the deployed API/version and account feature availability. ", "rights_review": "Original factual paraphrase and attributed source metadata only. Captured documentation and code remain private; no source prose, examples, images or vendor marks are redistributed. No licence to vendor software or buyer assurance is granted." } ], "observed_deployment": false, "commercial_reliance_boundary": "Source documentation supports only the stated boundary. Existing licensed checkers analyse supported supplied declarations; they do not query these providers, verify live systems, settle payments or certify compliance.", "paid_value": { "decision_context": "Review auth0 token revocation and grant scope before accepting the buyer claim. Administrative revocation scope depends on grant deletion settings, unlike automatic stale-token reuse detection.", "free": "Complete review, practical questions, source references and limitations; freely accessible and locally saveable.", "single_request": "Unavailable for this publication-only record; historical saved retrieval remains unchanged.", "evidence_receipt": "Unavailable for this publication-only record; no new paid retrieval entitlement.", "excluded": [ "Fresh vendor research", "Live provider inspection", "Runtime enforcement or certification", "Expanded executable schemas or licences", "Executable AI cost reconciliation" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck the source and applicable API, account and configuration before current reliance. No monitoring or fresh research is included.", "specific_watch": "Choose whether token revocation deletes grants; Considerations and limitations" }, "buyer_relevance": "Review auth0 token revocation and grant scope before accepting the buyer claim. Administrative revocation scope depends on grant deletion settings, unlike automatic stale-token reuse detection.", "refusal_conditions": [ "Do not infer all-device revocation or immediate expiry of existing access tokens from one device unlink.", "Do not infer buyer deployment conformance or successful business outcomes from source documentation." ] }, "niche": { "niche_id": "ice04-governance", "label": "Agent Governance & Policy Boundaries", "classification_id": "governance", "classification_label": "Agent Governance & Policy Boundaries", "topic_id": "governance", "buyer_intent": "Review auth0 token revocation and grant scope before accepting the buyer claim. Administrative revocation scope depends on grant deletion settings, unlike automatic stale-token reuse detection.", "comparison_role": "supplementary_discovery" }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#auth0-refresh-revocation-grant-scope", "machine_readable_record": "/varexis-index/records/auth0-refresh-revocation-grant-scope.json" } } ], "access": { "mode": "exact_http_only", "payment_required": false, "purchase_url": null, "mcp_preview_available": false, "paid_saved_retrieval_available": false, "natural_language_search_qualified": false }, "boundary": "Catalogue additions are available free through the exact HTTP JSON links below. Enhanced natural-language discovery is not yet qualified for these records. They are outside MCP search, MCP preview and paid saved retrieval. No search qualification, executable capability or entitlement is added.", "content_sha256": "052ccab786a0e9af7e8878eddec9af6e74b93b2c2c42b73378df04c49cd626a8" }