---
title: "Self-cancel by the current holder (requires the verificationCode; no auth header)"
method: POST
path: "/api/rightos/tokens/{tokenId}/holder-cancel"
tags: ["tokens"]
---

# Self-cancel by the current holder (requires the verificationCode; no auth header)

`POST /api/rightos/tokens/{tokenId}/holder-cancel`

## Request

- Base URL: `https://rightos.i-s3.com`
- URL: `https://rightos.i-s3.com/api/rightos/tokens/{tokenId}/holder-cancel`
- Auth: none required

The current holder proves possession with the verificationCode and cancels the token. Rejected with 409 policy_cancel_disabled when the location's policy sets holderCancellable=false. Operator cancellation via the authenticated cancel endpoint is always available regardless of this policy. Rate limited like verify (10/min per token per IP).

## Path parameters

- `tokenId` string, required

## Request body

- object
  - `verificationCode` string, required

## Response `200`

Cancelled token

- object
  - `token` RightToken: Public Right Token. The secretHash is never exposed by any endpoint.
    - `id` string
    - `organizationId` string
    - `locationId` string
    - `title` string
    - `description` string
    - `startTime` string, date-time
    - `endTime` string, date-time
    - `priorityNumber` integer: Daily issue sequence at this location (includes cancelled/used/expired). Not the live queue position — see queuePosition
    - `queuePosition` integer: Position in the active queue at issuance (issued + verified, not expired). ADR-0024
    - `status` 'issued' | 'verified' | 'used' | 'cancelled' | 'expired'
    - `transferCount` integer: Number of times transferred. 0 = original holder.
    - `createdAt` string, date-time
    - `usedAt` string, date-time
    - `cancelledAt` string, date-time
    - `transferredAt` string, date-time

## Other responses

- `400`: verificationCode is required
- `403`: unauthorized — wrong verificationCode
- `404`: Token not found
- `409`: not_cancellable (already used/cancelled/expired) or policy_cancel_disabled
- `429`: Rate limit exceeded (HTTP 429). See Retry-After header. Limits: verify/transfer = 10/min per IP+token and 60/min per IP; signup = 5/hour per IP.

---

[API](https://skmtc.dev/i-s3/apis/rightos-right-api.md) · [All operations](https://skmtc.dev/i-s3/apis/rightos-right-api/llms.txt) · [OpenAPI document](https://skmtc.dev/i-s3/apis/rightos-right-api/revisions/10020536e345?raw)