Revoke an API token

DELETE /tokens/{tokenId}

Auth Console session Role Owner or Manager

Revoke a token (not from a support session: SUPPORT_SESSION_NO_MINT). Requests with it fail from then on; the token stays in the list with revokedAt and revokedBy set. Requires a console session of an Owner or Manager.

Example

curl -X DELETE "https://api.autociso.io/api/v1/tokens/<tokenId>" \
  -H "Authorization: Bearer <console-session-token>"

import requests

response = requests.delete(
    "https://api.autociso.io/api/v1/tokens/<tokenId>",
    headers={"Authorization": "Bearer <console-session-token>"},
)
print(response.status_code)

const response = await fetch("https://api.autociso.io/api/v1/tokens/<tokenId>", {
  method: "DELETE",
  headers: { "Authorization": "Bearer <console-session-token>" },
});
console.log(response.status);

Response 204

No response body

Path parameters

tokenId string required
The token id (tokenId from the list).

Returns

Status 204 with no response body.

Errors

Status	Code	Retry	Meaning
401	`UNAUTHORIZED`	no	No signed-in session. code UNAUTHORIZED.
403	`FORBIDDEN`	no	The caller is not an Owner or Manager of the organization, or the request carries an API token (FORBIDDEN), or the session is a support session (SUPPORT_SESSION_NO_MINT on create and revoke).
404	`NOT_FOUND`	no	Unknown token id, or a token of another organization. code NOT_FOUND.
500	`DB_ERROR`	no	Unexpected server error. code DB_ERROR or TOKEN_GENERATION_FAILED; retry later and quote error.id if it persists.

Last reviewed: 2026-10-13

Was this page helpful?