---
title: "Revoke Resource Token"
method: DELETE
path: "/api/v1/resource-tokens/{token_id}"
tags: ["resource-tokens"]
---

# Revoke Resource Token

`DELETE /api/v1/resource-tokens/{token_id}`

## Request

- Base URL: `https://memory.kagura-ai.com` (the document declares no server; this is the origin it was published from)
- URL: `https://memory.kagura-ai.com/api/v1/resource-tokens/{token_id}`
- Auth: none declared

Revoke a resource token (soft delete).

Issue #242: Owner-only access. Sets is_active=False (preserves audit trail).
Issue #276: Uses WorkspaceOwner dependency for DRY principle.

The token is the WORKSPACE's to revoke (#1863): any owner may revoke any
token of the workspace, including one minted by a departed member or a
connector. It is resolved like the list, the update route and the quota
ceiling (#1919, ``auth.resource_tokens.workspace_tokens``): by the ``resources`` row its
``resource_pk`` points at — so a token whose contexts were deleted, or
whose shadow ``workspace_id`` was never backfilled, can still be revoked
while it still authenticates ingest.

Args:
    token_id: Public id of the token to revoke (``rtok_...``)
    owner: Workspace owner (user_id, workspace_id) from dependency
    manager: ResourceTokenManager instance
    db: Database session

Raises:
    403: Not workspace owner
    404: Token not found (or not this workspace's — the same answer)
    500: Failed to revoke token

## Path parameters

- `token_id` string, required: Public id of the resource token (`rtok_` + 22 base62 characters).

## Headers

- `authorization` string, nullable

## Response `204`

Successful Response

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud.md) · [All operations](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/revisions/09f17f5ada29?raw)