## Revoke a token

`DELETE /v1/infra/servers/:id/access-tokens/:tokenId`

Revokes a token early. New `share-url` visits and `api-bearer` calls are blocked immediately.

## Parameters

| Parameter | In | Type | Required | Description |
|----------|---|-----|:-----:|----------|
| `id` | path | string (UUID) | yes | BLACKHOLE server ID |
| `tokenId` | path | string | yes | Token ID from [`POST /access-tokens`](./create.md) or [`GET /access-tokens`](./list.md) |

## Examples

### curl — personal key

```bash
curl -X DELETE \
  -H "X-Api-Key: YOUR_API_KEY" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens/TOKEN_ID"
```

### curl — OAuth application

```bash
curl -X DELETE \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens/TOKEN_ID"
```

### JavaScript — personal key

```javascript
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens/${tokenId}`,
  {
    method: 'DELETE',
    headers: { 'X-Api-Key': 'YOUR_API_KEY' },
  }
)
// 204 No Content — no response body
if (res.status !== 204) {
  const { error } = await res.json()
  throw new Error(error.code)
}
```

### JavaScript — OAuth application

```javascript
await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens/${tokenId}`,
  {
    method: 'DELETE',
    headers: {
      'X-Api-Key': 'YOUR_APP_KEY',
      'Authorization': 'Bearer USER_SESSION_TOKEN',
    },
  }
)
```

## Response

`204 No Content` — no response body.

## Error response example

410 — token already revoked:

```json
{
  "success": false,
  "error": {
    "code": "ALREADY_REVOKED",
    "message": "Token already revoked"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|----------|
| 401 | `MISSING_API_KEY` | The `X-Api-Key` header was not provided |
| 401 | `INVALID_API_KEY` | Invalid or expired API key |
| 403 | `TOKEN_OWNER_MISMATCH` | The server or token belongs to a different API key |
| 404 | `SERVER_NOT_FOUND` | Server not found or deleted |
| 404 | `NOT_FOUND` | A token with this ID was not found or belongs to a different server |
| 410 | `ALREADY_REVOKED` | Token already revoked |

Full list of common API errors — [Errors](/docs/errors).

## Known specifics

- **`share-url` cookies keep working for up to 10 minutes after revocation.** Revocation immediately blocks new visits, but a browser with cookies already set sees the application until the session JWT expires.
- **An expired token cannot be revoked.** For expired tokens, `ALREADY_REVOKED` is returned.

## See also

- [Mint a token](./create.md)
- [List tokens](./list.md)
- [Access tokens](/docs/infra/access-tokens)