Skip to main content
POST
Issue or revoke a portal access token

Authorizations

hookie_session
string
cookie
required

The console's sealed session cookie, set by WorkOS AuthKit. Mutating requests also require the X-Requested-With CSRF header.

Headers

Idempotency-Key
string

Makes a POST safe to retry for 24 hours: the same key, credential, path and body returns the stored response (Idempotent-Replayed: true) instead of running again. 422 if the key was used for a different request; 409 while the first is in flight.

Required string length: 1 - 255

Path Parameters

project_id
string
required
portal_id
string
required

Body

application/json

One endpoint, three modes, discriminated by the presence of a string revoke or offboard.

customer_id
string
required

The tenant's own identifier for their end customer. Trimmed; must be non-empty. Compared exactly (case-sensitive) with the portal's current customer: a different id is a 409 (PORT-2g).

Minimum string length: 1
scopes
string[]

Stored on the token but not enforced by the portal API today.

expires_in_days
number

Must be finite and > 0 to take effect; anything else means the token never expires. The console defaults it to 30. A portal session made from the token never outlives it.

customer_name
string

Optional display name, shown to the customer in the portal instead of the id (#198). Trimmed; over 80 characters is a 400.

Maximum string length: 80

Response

Revoke or offboard mode.

ok
enum<boolean>
required
Available options:
true
destinations_disabled
integer

How many of the customer's destinations were switched off.

tokens_revoked
integer

Offboard mode only.