Revoke an API token
DELETE
/personal_access_tokens/{tokenId}
Soft-deletes the token by setting revoked_at. The token immediately stops working for API authentication. Audit trail is preserved. Session auth only — users can only revoke their own tokens.
Responses
Token revoked
application/json
JSON "toast": { "title": "User updated.", "message": [ [ "Successfully updated user." ] ], "variant": "success" }
{
}