I believe it's OAuth (same with JWT) in that there is no endpoint one can POST to in order to "logout," but the end-of-authorization concept exists in both OAut

I believe it's OAuth (same with JWT) in that there is no endpoint one can POST to in order to "logout," but the end-of-authorization concept exists in both OAuth and JWT via token revocation on the server-side SAML has an actual logout endpoint