For AI agents: markdown of this page — /docs-content-en/infra/access-tokens/delete.md documentation index — /llms.txt

Revoke a token

DELETE /v1/infra/servers/:id/access-tokens/:tokenId

Revokes a token early. New share-url visits and api-bearer calls are blocked immediately.

A development-team key with a current ADMIN or DEVELOPER role on this server can revoke only tokens issued by that same key. A token from another key returns 404 NOT_FOUND.

Parameters

Parameter In Type Required Description
Parameterid Inpath Typestring (UUID) Requiredyes DescriptionBLACKHOLE server ID. List: GET /v1/infra/servers
ParametertokenId Inpath Typestring (UUID) Requiredyes DescriptionToken ID saved from your own POST /access-tokens response; only the server-managing key can also obtain it through GET /access-tokens

Examples

curl — personal key

Terminal 
curl -X DELETE \
  -H "X-Api-Key: YOUR_API_KEY" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens/TOKEN_ID"

curl — OAuth application

Terminal 
curl -X DELETE \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens/TOKEN_ID"

JavaScript — personal key

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens/${tokenId}`,
  {
    method: 'DELETE',
    headers: { 'X-Api-Key': 'YOUR_API_KEY' },
  }
)
// 204 No Content — no response body
if (res.status !== 204) {
  const { error } = await res.json()
  throw new Error(error.code)
}

JavaScript — OAuth application

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens/${tokenId}`,
  {
    method: 'DELETE',
    headers: {
      'X-Api-Key': 'YOUR_APP_KEY',
      'Authorization': 'Bearer USER_SESSION_TOKEN',
    },
  }
)
// 204 No Content — no response body
if (res.status !== 204) {
  const { error } = await res.json()
  throw new Error(error.code)
}

Response

204 No Content — no response body. Success is indicated by the response code, not the content.

Response example

HTTP/1.1 204 No Content

Error response example

410 — token already revoked:

JSON 
{
  "success": false,
  "error": {
    "code": "ALREADY_REVOKED",
    "message": "Token already revoked"
  }
}

Errors

HTTP Code Description
HTTP401 CodeMISSING_API_KEY DescriptionNo API key was supplied through X-Api-Key or a supported Authorization: Bearer scheme
HTTP401 CodeINVALID_API_KEY DescriptionThe authentication key is not recognized
HTTP401 CodeKEY_INACTIVE DescriptionThe requesting API key is no longer active
HTTP401 CodeKEY_EXPIRED DescriptionThe requesting API key has expired; this is distinct from resource URL expiry
HTTP401 CodeNO_PORTAL DescriptionA non-management key has no portal binding
HTTP401 CodeCOWORK_CHAT_KEY_INACTIVE DescriptionThe parent device key behind a Cowork chat key is no longer usable
HTTP401 CodeWRONG_AUTH_SCHEME DescriptionAn OAuth application key was sent as a Bearer session: put the key in X-Api-Key and the session in Authorization: Bearer
HTTP401 CodeINVALID_SESSION DescriptionThe supplied OAuth session is invalid or expired
HTTP401 CodeTOKEN_EXPIRED DescriptionThe OAuth user token expired and its refresh failed; re-authorization is required
HTTP401 CodeTOKEN_INVALID DescriptionWhen the partner AI plane is enabled, its supplied token is unknown or expired
HTTP401 CodeKEY_REVOKED DescriptionThe partner credential behind the AI plane token is revoked
HTTP402 CodeACCOUNT_FROZEN DescriptionThe key owner’s account is frozen. With wallet-debt scoping disabled, the shared API-key guard refuses this call before its handler. Follow error.topupUrl to resolve the balance; this status alone does not authorize repeating a prior write.
HTTP403 CodeTOKEN_OWNER_MISMATCH DescriptionThe server belongs to a different API key. An exception is a development-team key with a current ADMIN or DEVELOPER role on this server.
HTTP403 CodeINFRA_FORBIDDEN_FOR_COWORK_KEY DescriptionThe call was made with a Cowork/Code key — such a key works with data only and cannot perform write operations. To issue a key that can, see Project key for deploy
HTTP403 CodeWRITE_BLOCKED_READONLY_KEY DescriptionA read-only key cannot perform this write.
HTTP403 CodeEXTERNAL_COLLABORATOR_KEY_OUT_OF_SCOPE DescriptionThis operation is outside the external-collaborator key route list. Use the key that manages the server
HTTP403 CodePORTAL_COLLABORATOR_KEY_WRONG_SERVER DescriptionThe development-team key is bound to another server
HTTP403 CodePORTAL_COLLABORATOR_NOT_A_MEMBER DescriptionDevelopment-team membership ended or the current role no longer permits this operation
HTTP403 CodeIP_NOT_ALLOWED DescriptionThe caller IP is outside the key allowlist.
HTTP403 CodeOWNER_BLOCKED DescriptionThe key owner is blocked.
HTTP403 CodeOWNER_DELETED DescriptionThe key owner was deleted.
HTTP403 CodePORTAL_SUSPENDED DescriptionThe bound portal is suspended.
HTTP403 CodePORTAL_DELETED DescriptionThe bound portal was deleted.
HTTP403 CodePORTAL_BLOCKED DescriptionThe bound portal is blocked.
HTTP403 CodeMANAGEMENT_KEY_NO_ENTITY_ACCESS DescriptionThe management key lacks the portal binding or entity authority required by this call.
HTTP403 CodeAGENT_MAINTENANCE_KEY_OUT_OF_SCOPE DescriptionThe maintenance key route list does not include this operation.
HTTP403 CodeAPP_API_KEY_OUT_OF_SCOPE DescriptionThe application key route list does not include this operation.
HTTP403 CodeWAITLIST_PENDING DescriptionThe key owner has not been activated.
HTTP403 CodeSESSION_APP_MISMATCH DescriptionThe OAuth session belongs to another application.
HTTP403 CodePLANE_FORBIDDEN DescriptionThe partner key does not allow this AI plane.
HTTP403 CodeSYSTEM_FORBIDDEN DescriptionThe partner key does not allow this AI system.
HTTP403 CodeSCOPE_FORBIDDEN DescriptionThe partner AI plane forbids this route.
HTTP403 CodeCONNECT_COMPANY_DERIVED_TOKEN_FORBIDDEN DescriptionA company connection key cannot manage derived tokens.
HTTP403 CodeCOWORK_READONLY DescriptionThe Cowork/Code seat is read-only.
HTTP403 CodeGALAXY_DISABLED DescriptionGalaxy operations are disabled for this portal.
HTTP404 CodeSERVER_NOT_FOUND DescriptionServer not found or deleted
HTTP404 CodeNOT_FOUND DescriptionThe server's portal has been deactivated; or a token with this ID was not found, belongs to a different server, or was issued by another key when called with a development-team key
HTTP410 CodeALREADY_REVOKED DescriptionToken already revoked
HTTP409 CodeAGENT_WRITE_ALREADY_EXECUTED DescriptionWith the agent-write replay guard enabled, this exact DELETE by the runtime agent key already has a claim and was not repeated. error.firstExecutedAt is the first claim timestamp; error.firstStatus is its HTTP status or null while the first attempt is still in flight. Reconcile and report that result; do not automatically repeat an unknown outcome. Failed first attempts release their claims
HTTP429 CodeQUOTA_EXCEEDED DescriptionAPI billing is enabled with a nonzero overage price: the daily free quota is exhausted and the PREPAY balance is not positive. Top up the balance. error.quota and error.used report counts; X-RateLimit-Quota, X-RateLimit-Used and X-RateLimit-Remaining report the quota, usage and zero remainder. This refusal does not promise Retry-After or X-RateLimit-Scope
HTTP429 CodeCALLER_RATE_LIMITED DescriptionThe shared key or user request limit. Wait for the number of seconds specified in Retry-After; X-RateLimit-Scope identifies the refusing layer
HTTP503 CodeFEATURE_DISABLED DescriptionThe access-tokens section is disabled on the platform. The pre-call signal and the fallback are described in Availability
HTTP503 CodeACCOUNT_PENDING_ERASURE DescriptionThe key owner is pending erasure or being erased. Header Retry-After: 3600.
HTTP503 CodeSERVICE_DISABLED DescriptionThe partner AI plane or its quota-readiness service is disabled. No Retry-After is promised for this refusal.
HTTP503 Codeuser_self_deletion_pending DescriptionThe API key owner scheduled self-deletion. The token plugin refuses the call before its handler. Header Retry-After: 604800.

Full list of common API errors — Errors.

Known specifics

  • share-url cookies keep working for up to 10 minutes after revocation. Revocation immediately blocks new visits, but a browser with cookies already set sees the application until the session JWT expires.
  • An expired token can still be revoked. Revocation looks only at the revoked flag, so a record with an expiresAt in the past accepts DELETE and returns 204. Refreshing such a record, by contrast, returns 410 TOKEN_EXPIRED — Refresh a token.

See also