---
# @generated by sylphx-gen. Do not edit.
title: "Revoke a token exchange"
description: "`broker.token_exchanges.revoke` (POST /v1/{name}:revoke): Revokes an issued credential at the provider by its record."
type: reference
product: platform
summary: "Revokes an issued credential at the provider by its record."
updated: 2026-09-28
nav: false
---

Revokes an issued credential at the provider by its record. The Broker uses the credential it holds sealed, so the caller needs no token and no live delegation. Idempotent: a credential already revoked or expired answers the record. Erases the sealed credential once the provider confirms.

- **Path** `POST https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange:revoke`
- **Scope** `broker:read`
- **Effect** `destructive` — a successful call removes data; the CLI asks before it runs.
- **Collection** [token_exchanges](/docs/api/token_exchanges)

## Request

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | The record of the credential to revoke. Required. |

## Response

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | `orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}`. |
| `uid` | `string` | `tkx_<cell><ulid>`; also the `{token_exchange}` id. Output only. |
| `meta` | `ResourceMeta` | Resource metadata. |
| `subject` | `string` | The accountable principal, `orgs/{org}/principals/{id}`. Output only. |
| `actor` | `string` | The Agent the subject's delegated grant acted for; empty when the subject exchanged for itself. Output only. |
| `repository` | `string` | The one repository the credential covers, `owner/name`. Output only. |
| `permissions` | `map<string, string>` | The permissions the credential carries. Output only. |
| `credential_kind` | `CredentialKind` | What the credential is. Output only. One of `access_token`, `runner_registration`. |
| `create_time` | `timestamp` | When it was issued. Output only. |
| `expire_time` | `timestamp` | When the provider stops honoring it. Output only. |
| `revoke_time` | `timestamp` | When the provider confirmed it revoked; unset while live or when it simply expired. Output only. |
| `token_sha256` | `string` | Lowercase hex SHA-256 of the credential, to match a credential seen elsewhere to its record. Output only. |
| `connection` | `string` | The Connection the credential was issued on. Output only. |
| `issuer` | `string` | The provider identity that signed it: for GitHub, `github-apps/{app_id}`. Output only. |

### ResourceMeta

| Field | Type | What it is |
| --- | --- | --- |
| `generation` | `int64` | Increases by one on every change to `spec`. Output only. |
| `etag` | `string` | Strong ETag (AIP-154): changes on any change to spec, status, or metadata. Send it back as `If-Match` or `etag` to make Update and Delete conditional; a mismatch fails with ABORTED / 409 `ETAG_MISMATCH`. Output only. |
| `create_time` | `timestamp` | When the Resource was created. Output only. |
| `update_time` | `timestamp` | When the Resource last changed. Output only. |
| `delete_time` | `timestamp` | Set while the Resource is being deleted. Output only. |
| `labels` | `map<string, string>` | Caller-writable, indexed labels (AIP-122 label rules). |
| `annotations` | `map<string, string>` | Caller-writable, unindexed annotations. |
| `display_name` | `string` | Caller-writable human-readable name. |
| `creator` | `string` | The principal that created the Resource. Output only. |

## Errors

- [`UNAUTHENTICATED`](/docs/api/errors/UNAUTHENTICATED) — No valid key or token was presented.
- [`PERMISSION_DENIED`](/docs/api/errors/PERMISSION_DENIED) — The key lacks the method's permission.
- [`RESOURCE_NOT_FOUND`](/docs/api/errors/RESOURCE_NOT_FOUND) — The named Resource does not exist or is not visible.
- [`UNAVAILABLE`](/docs/api/errors/UNAVAILABLE) — The Resource store, the owning service's backend, or the key verifier's snapshot is unavailable; retry after Retry-After.

Every error arrives in the body [Errors](/docs/platform/errors) describes.

## Examples

**cURL**

```curl
curl -X POST "https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange:revoke" \
  -H "Authorization: Bearer $SYLPHX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'
```

**TypeScript**

```ts
const response = await sylphx.broker.tokenExchanges.revoke({ name: 'orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange' })
```

**Rust**

```rust
let mut req = sylphx::broker::RevokeTokenExchangeRequest::default();
req.name = "orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange".to_string();
let response = sx.broker().token_exchanges().revoke(req).await?;
```

**CLI**

```bash
sylphx broker token-exchanges revoke orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange --yes
```

**MCP**

```json
{ "method_id": "broker.token_exchanges.revoke", "args": {"name":"orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange"} }
```