Revoke an outstanding issuance token
Owner-side kill switch for a handed-out issuance token. Sets revoked_at so the token can never redeem — the redeem RPC's atomic WHERE clause excludes revoked rows. Idempotent by contract: revoking an already-revoked OR already-redeemed token is a no-op that still returns 200 (the owner's intent — this token must not issue anything further — is already satisfied either way; only a genuine transition writes an issuance_token.revoke audit event). A token that does not exist or belongs to another account returns 404, and those two cases are deliberately collapsed so the token-id space cannot be enumerated across tenants. Session-cookie auth; cross-tenant isolation is the session-resolved consumer_id predicate on the service-role update (key_issuance_tokens is service_role-only RLS — token hashes never reach a client-facing Postgres role). Inline rate limit: 30 revokes per hour per consumer, fail-CLOSED.
Request
- Base URL: https://www.apier.no
- URL: https://www.apier.no/api/v1/account/issuance-tokens/{id}
- Auth: API key in cookie sb-access-token
Response
Token revoked — or was already revoked / already redeemed (idempotent no-op; the response shape does not distinguish, matching the owner's satisfied intent).
Example response
{
"_meta": {
"rulebook_version": "v1.0.0",
"source": "apier.no",
"data_source": "Brønnøysund Enhetsregisteret + Apier Universal Rulebook",
"schema_version": "1.0.0",
"legal_basis": "NLOD — public registry reuse",
"response_timestamp": "2026-04-24T12:00:00.000Z",
"response_hash": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"source_snapshot_id": "brreg-2026-04-24T02:00:00.000Z",
"cost_nok": 0.5,
"wallet_remaining_nok": 9.5,
"spend_cap_remaining_nok": 12.5
}
}Changes
No recorded changes to this operation across all 1 revision of this API.