Skip to main content
Service Account Tokens

Revoke a Service Account Token

Immediately revoke an issued Service Account Token.
POST /api/v1/forward/service_account_tokens/{auth_token_id}/revoke After revocation, the token becomes invalid immediately and subsequent business requests that use it are rejected. Use this endpoint when a token may have leaked or an end-user session ends early.

Request headers

HeaderRequiredDescription
AuthorizationYesBearer <Service Account Key>
Content-TypeYesapplication/json

Path parameters

ParameterTypeRequiredDescription
auth_token_idstringYesUnique ID of the token to revoke, from auth_token_id in the token creation response.

Request body

ParameterTypeRequiredDescription
target_credential_idstringNoIssuing Key ID from credential_id in the creation response, used to identify the target precisely.
target_expires_atstringNoToken expiration time from expires_at in the creation response, in RFC 3339 format, used to identify the target precisely.
reasonstringNoRevocation reason for auditing.

Example request

curl -s -X POST 'https://api.qoder.com/api/v1/forward/service_account_tokens/3f8a2b1c-6d4e-4f2a-9b7c-1e5d8a0c4b2f/revoke' \
  -H "Authorization: Bearer $QODER_SA_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "suspected_leak"
}'

Example response

HTTP 200 OK 
{
  "revoked": true
}

Response fields

FieldTypeDescription
revokedbooleanWhether revocation succeeded. Always true.

Errors

HTTPTypeCodeCondition
400invalid_request_error-The request body is invalid, or target_expires_at is not a valid RFC 3339 time.
401authentication_error-The Service Account Key is invalid or expired, or another credential type was used.
404not_found_error-The target token does not exist or does not belong to the current Service Account.
409conflict_error-The locating conditions match multiple tokens. Add target_credential_id or target_expires_at to identify the token precisely.

Notes

  • Revocation cannot be undone. Create a new token to continue access.
  • You can revoke only tokens issued under the same Service Account.
  • If a Key may have leaked, revoke the token and rotate the Service Account Key on the Enterprise credentials page in the Qoder console.

Create a Service Account Token

Create a Service Account Token for an Identity

First steps
Define your agent
Configure agent environment
Delegate work to your agent
Agent integrations
Manage agent context
Account
Best Practices
Announcements
API reference