You can revoke a token issued by Integration Server using the pub.oauth:revokeToken service in the WmPublic package. The pub.oauth:revokeToken service revokes all of the tokens related to a specified token. If the token is an access token, the service revokes the associated refresh token as well. If the token is a refresh token, the service revokes the associated access token as well.
For more information about the pub.oauth:revokeToken service, see webMethods Integration Server Built-In Services Referencepub.oauth:revokeToken