---
title: "Operator: revoke one personal token of a person"
method: DELETE
path: "/api/ops/users/{userId}/tokens/{tokenId}"
tags: ["Operator"]
---

# Operator: revoke one personal token of a person

`DELETE /api/ops/users/{userId}/tokens/{tokenId}`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/api/ops/users/{userId}/tokens/{tokenId}`
- Auth: one of:
  - API key in cookie `__Secure-authjs.session-token`
  - API key in cookie `authjs.session-token`

Operator console only: requires the web session of an address in the operator allowlist of this installation, sent from the application itself. Every other signed-in caller and every valid Bearer token receives 404 NOT_FOUND, whether or not this installation has an operator configured; a caller with no valid credential receives 401, as on every route. Recorded in the operator log. Calls made with the token answer 401 from now on. Tre does not notify its owner. The body gives the reason, from a closed list, and may give a reference: a ticket or card key, never an address. A token that is not this person’s, is not a personal token or is already revoked answers 404.

## Request body

- OpsCredentialRevoke
  - `reasonCode` 'security_incident' | 'customer_request' | 'acceptable_use', required
  - `reference` string

## Response `204`

No content

## Other responses

- `400`: Invalid request
- `401`: Unauthenticated
- `403`: The request did not come from the application’s own origin
- `404`: Not the operator, or no such object
- `409`: Conflict
- `429`: Rate limited
- `500`: Internal server error
- `503`: Temporarily unavailable

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)