For AI agents: markdown of this page — /docs-content-en/infra/access-tokens/delete.md documentation index — /llms.txt

Revoke a token

DELETE /v1/infra/servers/:id/access-tokens/:tokenId

Revokes a token early. New share-url visits and api-bearer calls are blocked immediately.

Parameters

Parameter In Type Required Description
id path string (UUID) yes BLACKHOLE server ID
tokenId path string yes Token ID from POST /access-tokens or GET /access-tokens

Examples

curl — personal key

Terminal 
curl -X DELETE \
  -H "X-Api-Key: YOUR_API_KEY" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens/TOKEN_ID"

curl — OAuth application

Terminal 
curl -X DELETE \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens/TOKEN_ID"

JavaScript — personal key

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens/${tokenId}`,
  {
    method: 'DELETE',
    headers: { 'X-Api-Key': 'YOUR_API_KEY' },
  }
)
// 204 No Content — no response body
if (res.status !== 204) {
  const { error } = await res.json()
  throw new Error(error.code)
}

JavaScript — OAuth application

javascript 
await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens/${tokenId}`,
  {
    method: 'DELETE',
    headers: {
      'X-Api-Key': 'YOUR_APP_KEY',
      'Authorization': 'Bearer USER_SESSION_TOKEN',
    },
  }
)

Response

204 No Content — no response body.

Error response example

410 — token already revoked:

JSON 
{
  "success": false,
  "error": {
    "code": "ALREADY_REVOKED",
    "message": "Token already revoked"
  }
}

Errors

HTTP Code Description
401 MISSING_API_KEY The X-Api-Key header was not provided
401 INVALID_API_KEY Invalid or expired API key
403 TOKEN_OWNER_MISMATCH The server or token belongs to a different API key
404 SERVER_NOT_FOUND Server not found or deleted
404 NOT_FOUND A token with this ID was not found or belongs to a different server
410 ALREADY_REVOKED Token already revoked

Full list of common API errors — Errors.

Known specifics

  • share-url cookies keep working for up to 10 minutes after revocation. Revocation immediately blocks new visits, but a browser with cookies already set sees the application until the session JWT expires.
  • An expired token cannot be revoked. For expired tokens, ALREADY_REVOKED is returned.

See also