Invalidate Token

DELETE /{namespace}/{principalType}/{principalId}/tokens/{tokenId}

Revokes the access key's active record so subsequent website and API requests using that bearer are rejected. The token ID is the ID returned by create/list and carried in its JWT jti claim. Only the owner may revoke it. OAuth connections explicitly approved with a website key are independent grants and must be revoked separately.

Requires a signed user/session or the existing authenticated client flow. The anonymous DCR delegated device profile cannot invoke this operation.

Required scope

Any authenticated access token

Path parameters

tokenIdstringRequired: The token identifier (partial ID)
namespacestringRequired: The namespace of the principal
principalTypestringRequired: The type of principal
principalIdstringRequired: The ID of the principal

Returns

200

Token invalidated successfully

Fields

messagestringRequired: Confirmation message (e.g. "Token invalidated successfully").

Errors

401

Unauthorized

Obtain a valid access token, then retry.

403

Forbidden - not owner of the token

Check the linked account and its permissions for the device or resource.

404

Token id not found

Verify the target identifier and that its endpoint or plugin route still exists.

500

Internal server error

Retry with backoff only when the operation is safe to repeat. Include the error code when reporting persistent failures.