A method for revoking authorization for an API invoker in a first apparatus. The method comprises sending to a second apparatus a request for revoking authorization of an Application Program Interface (API) for the API invoker with an API invoker ID, an API Exposing Function (AEF) identifier and at least one API identifier; and receiving a response to the request from the second apparatus wherein the API identified by the at least one API identifier is part of all the APIs authorized for the API invoker.