v1
latestOpenAPI 3.0.1MIT2026-07-134925112.4 KBRevoke Organization API Token
Revokes a token scoped to this organization.
The path takes a token ID, not a name, because names are unique per user but not across users — an admin revoking a member's token can't disambiguate by name alone.
Authorization is symmetric with the list endpoint:
- Admins and owners can revoke any token scoped to the organization (org-scoped or group-scoped, regardless of who minted it).
- Members and viewers can revoke only tokens they minted themselves.
A token scoped to a different organization returns 404, not 403, so the endpoint does not leak the existence of cross-org token IDs. Unrestricted tokens are also unreachable here and must be revoked via DELETE /v1/auth/api-tokens/{tokenName}.
delete/v1/organizations/{organizationSlug}/api-tokens/{tokenId}
Path parameters
organizationSlugstring required
The slug of the organization or user account.
tokenIdstring required
The ID of the token to revoke (from the list endpoint).
Response
Successful response
Example response
{
"token": "clGFZ4STEe6fljpFzIum8A"
}