Tokens
Revoke Token by ID
Revoke a personal API token — it stops working immediately and irreversibly.
DELETE
Revokes one personal API token by ID. The token stops authenticating immediately and revocation is irreversible — to restore access, create a new token. Find the
tokenId via GET /tokens.
Tokens belonging to another account return 404 — the API never confirms the existence of a token the caller does not own. To revoke by presenting the token itself instead of its ID (RFC 7009), use POST /api/agent/identity/revoke.
Requirements: any valid token — token management needs no specific scope or feature flag, and works pre-claim.
Request
string
required
The token ID (not the
ot_pat_ secret) from GET /tokens.Response
object
The revoked token record — same shape as the entries in
GET /tokens, now with status: "revoked" and revokedAt set.