Revolo API

Authentication

Revolo is the authorization server at https://app.revolo.ai. Your DMS is a confidential OAuth 2.0 client. Revolo provisions client_id, client_secret, and registered redirect_uris for your application.

Authorization code + PKCE

Use response_type=code and PKCE (S256). state is required. Scopes are space-delimited.

Scopes

  • workflows:read — list workflows
  • assets:write — create vehicles
  • workflows:send — send vehicles to workflows

1. Send the user to authorize

text
https://app.revolo.ai/oauth/authorize?response_type=code&client_id=rev_your_client_id&redirect_uri=https://your-dms.example/oauth/callback&state=random-csrf-value&scope=workflows:read%20assets:write%20workflows:send&code_challenge=BASE64URL_SHA256_VERIFIER&code_challenge_method=S256

The user signs in with their Revolo account, picks an organization that has API access enabled, and clicks Allow. Revolo redirects back to your redirect_uri with code and the original state.

2. Exchange the code

POST /oauth/token accepts application/x-www-form-urlencoded or JSON. Authenticate with client_id and client_secret in the body, or HTTP Basic.

bash
curl -X POST https://app.revolo.ai/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "client_id=rev_your_client_id" \
  -d "client_secret=your_client_secret" \
  -d "code=AUTH_CODE" \
  -d "redirect_uri=https://your-dms.example/oauth/callback" \
  -d "code_verifier=YOUR_PKCE_VERIFIER"
json
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "hex-refresh-token",
  "scope": "workflows:read assets:write workflows:send"
}

3. Call the API

bash
curl https://app.revolo.ai/api/v1/organization \
  -H "Authorization: Bearer ACCESS_TOKEN"

Refresh tokens

Access tokens expire after one hour. Refresh tokens last 90 days and are rotated on each refresh.

bash
curl -X POST https://app.revolo.ai/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=rev_your_client_id" \
  -d "client_secret=your_client_secret" \
  -d "refresh_token=REFRESH_TOKEN"

Revoke

bash
curl -X POST https://app.revolo.ai/oauth/revoke \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=rev_your_client_id" \
  -d "client_secret=your_client_secret" \
  -d "token=ACCESS_OR_REFRESH_TOKEN"

A Revolo owner or admin can also revoke the entire connection from Settings → Integrations. After revoke, subsequent API calls return 401.

Exact redirect URI match

redirect_uri must match a URI registered for your client, including scheme, host, path, and query. Revolo rejects unknown redirect URIs on the authorize page before the user signs in.