---
title: "Revoke a personal access token (soft revoke, audit trail kept)"
method: DELETE
path: "/api/v0/tokens/{id}"
tags: ["Auth"]
---

# Revoke a personal access token (soft revoke, audit trail kept)

`DELETE /api/v0/tokens/{id}`

## Request

- Base URL: `https://app.vibeflow.tools`
- URL: `https://app.vibeflow.tools/api/v0/tokens/{id}`
- Auth: HTTP bearer

Plan §4.5/H1: sets revoked_at; api_tokens is the single authority so revocation is structurally authoritative — no fallback path can authenticate the string.

## Path parameters

- `id` string, required

## Response `200`

Revoke a personal access token (soft revoke, audit trail kept) — success

- object
  - `success` boolean, required

## Other responses

- `400`: Malformed request (includes invalid task/comment id form)
- `401`: Missing or invalid principal
- `403`: Lacking scope or membership
- `404`: Unknown id
- `429`: Rate limited — cloud per-token quota exceeded (reads 300/min, writes 60/min, token creation 10/hour); counters are per-replica, so the effective limit is the configured value × replicas. The response carries Retry-After.

---

[API](https://skmtc.dev/vibeflow/apis/vibeflow-api-v0.md) · [All operations](https://skmtc.dev/vibeflow/apis/vibeflow-api-v0/llms.txt) · [OpenAPI document](https://skmtc.dev/vibeflow/apis/vibeflow-api-v0/revisions/efd4ba944b0b?raw)