# Revoke an API token

Revoke a token (not from a support session: SUPPORT_SESSION_NO_MINT).

`DELETE /tokens/{tokenId}`

Auth **Console session** | Role **Owner or Manager**

Revoke a token (not from a support session: SUPPORT_SESSION_NO_MINT). Requests with it fail from then on; the token stays in the list with `revokedAt` and `revokedBy` set. Requires a console session of an Owner or Manager.

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `tokenId` | string | yes | The token id (`tokenId` from the list). |

## Returns

Status 204 with no response body.

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 401 | `UNAUTHORIZED` | no | No signed-in session. code UNAUTHORIZED. |
| 403 | `FORBIDDEN` | no | The caller is not an Owner or Manager of the organization, or the request carries an API token (FORBIDDEN), or the session is a support session (SUPPORT_SESSION_NO_MINT on create and revoke). |
| 404 | `NOT_FOUND` | no | Unknown token id, or a token of another organization. code NOT_FOUND. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR or TOKEN_GENERATION_FAILED; retry later and quote error.id if it persists. |

## Example

### curl

```bash
curl -X DELETE "https://api.autociso.io/api/v1/tokens/<tokenId>" \
  -H "Authorization: Bearer <console-session-token>"
```

### Python

```python
import requests

response = requests.delete(
    "https://api.autociso.io/api/v1/tokens/<tokenId>",
    headers={"Authorization": "Bearer <console-session-token>"},
)
print(response.status_code)
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/tokens/<tokenId>", {
  method: "DELETE",
  headers: { "Authorization": "Bearer <console-session-token>" },
});
console.log(response.status);
```