---
title: "Revoke Global Admin Token"
method: POST
path: "/global-admin/tokens/{token_id}/revoke"
---

# Revoke Global Admin Token

`POST /global-admin/tokens/{token_id}/revoke`

## Request

- Base URL: `https://api-docs.session-exchange.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api-docs.session-exchange.com/global-admin/tokens/{token_id}/revoke`
- Auth: none declared

Revoke one global-admin token by id (GLOBAL admin or break-glass only).

* The token itself is refused from the next request on every collector auth path
  (`_deps._resolve_global_admin`, used by resolve_request_token, require_global_admin,
  is_global_admin and the fleet scope, reads the in-memory registry on each request — nothing
  caches the verdict). Open SSE streams close at their next auth re-check (≤
  AGENT_MDX_SSE_AUTH_RECHECK_S, default 60 s). NOT revoked: OIDC JWTs it already minted via
  POST /auth/token — consumers verify those offline against the JWKS, so they stay valid until
  their own `exp` (fleetcache ≤ 600 s, world-sim ≤ 3600 s; oidc._AUD_TTL), nor tokens it
  minted (`issued_by`). Survives a restart (JSONL replay keeps the last line per hash and
  revocation is terminal; bootstrap does not re-mint while the registry holds any row).
* Idempotent: a revoked token is 200 with `already_revoked: true`, no second audit line.
* Self-revoke (the token this request is authenticated with) needs `?confirm=self`, else 409
  `confirm_self_revoke` and nothing changes.
* Never strands the platform: revoking the last ACTIVE global-admin token is refused 409
  `last_admin` unless the env break-glass (AGENT_MDX_BREAKGLASS_ADMIN) is configured — even
  with confirm. Recovery then is break-glass → POST /global-admin/tokens.
* Audited to the global audit log as `global_admin.revoked` with the acting admin
  (owner id + credential id or `breakglass`).

## Path parameters

- `token_id` string, required

## Query parameters

- `confirm` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/session-exchange/apis/a4sx.md) · [All operations](https://skmtc.dev/session-exchange/apis/a4sx/llms.txt) · [OpenAPI document](https://skmtc.dev/session-exchange/apis/a4sx/revisions/abaefc33dfc7?raw)