Revoke a token exchange

Revokes an issued credential at the provider by its record.

Checked 2026-09-28

Revokes an issued credential at the provider by its record. The Broker uses the credential it holds sealed, so the caller needs no token and no live delegation. Idempotent: a credential already revoked or expired answers the record. Erases the sealed credential once the provider confirms.

Path POST https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange:revoke
Scope broker:read
Effect destructive — a successful call removes data; the CLI asks before it runs.
Collection token_exchanges

#Request

Field	Type	What it is
`name`	`string`	The record of the credential to revoke. Required.

#Response

Field	Type	What it is
`name`	`string`	`orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}`.
`uid`	`string`	`tkx_<cell><ulid>`; also the `{token_exchange}` id. Output only.
`meta`	`ResourceMeta`	Resource metadata.
`subject`	`string`	The accountable principal, `orgs/{org}/principals/{id}`. Output only.
`actor`	`string`	The Agent the subject's delegated grant acted for; empty when the subject exchanged for itself. Output only.
`repository`	`string`	The one repository the credential covers, `owner/name`. Output only.
`permissions`	`map<string, string>`	The permissions the credential carries. Output only.
`credential_kind`	`CredentialKind`	What the credential is. Output only. One of `access_token`, `runner_registration`.
`create_time`	`timestamp`	When it was issued. Output only.
`expire_time`	`timestamp`	When the provider stops honoring it. Output only.
`revoke_time`	`timestamp`	When the provider confirmed it revoked; unset while live or when it simply expired. Output only.
`token_sha256`	`string`	Lowercase hex SHA-256 of the credential, to match a credential seen elsewhere to its record. Output only.
`connection`	`string`	The Connection the credential was issued on. Output only.
`issuer`	`string`	The provider identity that signed it: for GitHub, `github-apps/{app_id}`. Output only.

#ResourceMeta

Field	Type	What it is
`generation`	`int64`	Increases by one on every change to `spec`. Output only.
`etag`	`string`	Strong ETag (AIP-154): changes on any change to spec, status, or metadata. Send it back as `If-Match` or `etag` to make Update and Delete conditional; a mismatch fails with ABORTED / 409 `ETAG_MISMATCH`. Output only.
`create_time`	`timestamp`	When the Resource was created. Output only.
`update_time`	`timestamp`	When the Resource last changed. Output only.
`delete_time`	`timestamp`	Set while the Resource is being deleted. Output only.
`labels`	`map<string, string>`	Caller-writable, indexed labels (AIP-122 label rules).
`annotations`	`map<string, string>`	Caller-writable, unindexed annotations.
`display_name`	`string`	Caller-writable human-readable name.
`creator`	`string`	The principal that created the Resource. Output only.

#Errors

UNAUTHENTICATED — No valid key or token was presented.
PERMISSION_DENIED — The key lacks the method's permission.
RESOURCE_NOT_FOUND — The named Resource does not exist or is not visible.
UNAVAILABLE — The Resource store, the owning service's backend, or the key verifier's snapshot is unavailable; retry after Retry-After.

Every error arrives in the body Errors describes.

#Examples

curl -X POST "https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange:revoke" \
  -H "Authorization: Bearer $SYLPHX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Was this page helpful?

Tell us what is missing, wrong, or unclear — this opens a real inbox.

Send feedback

Platform links