Revoke a Token

Permanently revoke a personal access token with the deletePersonalAccessToken mutation. It stops authenticating immediately.

Use the deletePersonalAccessToken mutation to permanently revoke a personal access token (a PersonalAccessToken object). Revocation is immediate and irreversible: the moment the mutation returns, the token stops authenticating and any request carrying its credentials begins failing.

You identify the token by its Token ID — the unprefixed uid you also send in the X-Bloo-Token-ID header, and the id returned by List Tokens. It is not the pat_-prefixed Secret; the Secret is never accepted as an argument and, after creation, is never recoverable.

You can only revoke your own tokens. The mutation is scoped to the calling user, so an ID belonging to another user is indistinguishable from one that does not exist — both raise PERSONAL_ACCESS_TOKEN_NOT_FOUND.

Token management needs a user session

Like creating a token, revoking one requires an authenticated user session (the Firebase/JWT login the app uses). It cannot be performed while authenticating with a token: if the request carries X-Bloo-Token-ID headers, the mutation returns FORBIDDEN. Revoke tokens from a logged-in browser session, not from an API integration.

Request

mutation RevokeToken {
  deletePersonalAccessToken(input: { id: "pat_123" })
}

deletePersonalAccessToken returns the scalar Boolean, so the call takes no sub-selection. It resolves to true on success.

Authenticate with a user session, not token headers (see the callout above):

Authorization: Bearer YOUR_SESSION_JWT
X-Bloo-Company-ID: YOUR_COMPANY_ID

Parameters

DeletePersonalAccessTokenInput

ParameterTypeRequiredDescription
idID!YesThe Token ID (the PersonalAccessToken.id from List Tokens), not the pat_-prefixed Secret.

Response

{
  "data": {
    "deletePersonalAccessToken": true
  }
}

Returns

FieldTypeDescription
deletePersonalAccessTokenBooleantrue when the token was revoked. Errors are returned otherwise.

Errors

CodeWhen
PERSONAL_ACCESS_TOKEN_NOT_FOUNDNo token owned by the caller matches id — the ID is unknown, already revoked, or belongs to another user. Message: Personal access token was not found.
FORBIDDENThe request authenticated with a token instead of a user session (an X-Bloo-Token-ID header was present). Message: You are not authorized.
{
  "errors": [
    {
      "message": "Personal access token was not found.",
      "extensions": { "code": "PERSONAL_ACCESS_TOKEN_NOT_FOUND" }
    }
  ]
}

Permissions

You must be authenticated with a user session, and you can only revoke tokens you own. Both the foreign-ID and unknown-ID cases return PERSONAL_ACCESS_TOKEN_NOT_FOUND — the mutation never reveals whether a token exists under another user.

Revocation is permanent: Blue stores only a bcrypt hash of the Secret, so a revoked token cannot be restored or re-enabled. To replace it, create a new token and capture its Secret. If you only want a token to stop working at a future date rather than now, set expiredAt when you create it instead of revoking it manually.