---
title: "Revoke a Personal Access Token"
method: POST
path: "/api/companies/{companyId}/pats/{patId}/revoke"
tags: ["Tokens"]
---

# Revoke a Personal Access Token

`POST /api/companies/{companyId}/pats/{patId}/revoke`

## Request

- Base URL: `https://comply.strac.io`
- URL: `https://comply.strac.io/api/companies/{companyId}/pats/{patId}/revoke`
- Auth: HTTP bearer

Soft-revoke (the row is preserved for the audit trail). The PAT stops working on the next request, with no grace period. The optional reason is stored on the token record, not in the audit log.

Role gate: owner / admin (or the token owner).

Scope: `any`.

## Path parameters

- `companyId` string, required
- `patId` string, required

## Request body

- object
  - `reason` string: Why the token was revoked (e.g. rotation, offboarding).

## Response `200`

Revoke a Personal Access Token

---

[API](https://skmtc.dev/strac/apis/strac-comply-api.md) - [All operations](https://skmtc.dev/strac/apis/strac-comply-api/llms.txt) - [OpenAPI document](https://skmtc.dev/strac/apis/strac-comply-api/revisions/d5558b64eeeb?raw)