.svg?fit=max&auto=format&n=vy0mukkT7J4oGoAc&q=85&s=309fd13aafaa2459ab88bae66ee69fdb)
.svg?fit=max&auto=format&n=vy0mukkT7J4oGoAc&q=85&s=d463f8e401c13f13ee15256db8c610dd)
Agent auth
Revoke Token
Revoke a personal API token (RFC 7009).
POST
Revokes a personal API token, following RFC 7009: the call always returns
200, even for unknown or already-revoked tokens, so revocation can never leak whether a token existed.
The body is form-encoded (application/x-www-form-urlencoded). Use this when decommissioning an integration or responding to a suspected leak. For routine rotation, prefer the token management API, which can also revoke other tokens on the account by ID.
Requirements: none beyond possessing the token value to revoke.
Request
string
required
The
ot_pat_... token to revoke.Response
200 with an empty JSON body. The token stops authenticating immediately.