> This page is for API, version 2026-01-01 (Stable) (default).
> For other versions, use one of these documentation indexes:
> - 2026-01-01 (Stable) (default): https://developer.deel.com/api/stable/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.deel.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.deel.com/_mcp/server.

# Invalidate an API token

POST https://api.letsdeel.com/rest/api-tokens/{token_id}/invalidate
Content-Type: application/json

Invalidates an API token that should no longer be used, most importantly one that has been leaked or breached, or a stale or orphaned one found through the list of API tokens. It stops authenticating right away and cannot be restored, and its secret is dropped. The token stays listed as invalidated, with who invalidated it and why. Invalidating a token that is already inactive or expired leaves it unchanged.

 **Token scopes**: `tokens:write`

 **Beta**: this version requires the `X-Beta: true` request header and its contract may change before it is promoted to stable. It is scheduled to become stable on 2027-02-05.

Reference: https://developer.deel.com/api/reference/endpoints/api-tokens/invalidate-api-token-v-2026-11-05

## Authentication

- `Authorization` header (bearer token, required) — ## Authentication The Deel API uses bearer tokens to authenticate requests. All API calls must be made over HTTPS — calls over plain HTTP or without authentication will fail. ```curl curl -X GET 'https://api.letsdeel.com/rest/v2/contracts' \ -H 'Authorization: Bearer YOUR-TOKEN-HERE' ``` [Learn more about authentication](/api/authentication)
- `Authorization` header (bearer token, required) — Standard OAuth2 security scheme based on https://swagger.io/docs/specification/authentication/

## Servers

- `https://api.letsdeel.com/rest` (Production, default)
- `https://api-staging.letsdeel.com/rest` (Demo)

## Request

### Path parameters

- `token_id` (string, required) — Unique identifier of the API token.

### Headers

- `X-Beta` (enum, required, default: true) — Opts in to the beta version of this endpoint. Must be `true`.
  - Allowed values: `true`

### Body (application/json)

This endpoint expects an object.

- `data` (ApiTokensTokenIdInvalidatePostRequestBodyContentApplicationJsonSchemaData, optional) — Details of the invalidation.

## Response

### 200

The API token is invalidated.

- `data` (ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaData, required)

## Errors

### 400 Bad Request Error

Bad Request. A parameter is missing or invalid.

- `errors` (list of ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail.

### 401 Unauthorized Error

Unauthorized. Authentication credentials were missing or invalid.

- `errors` (list of ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail.

### 403 Forbidden Error

Forbidden. The caller cannot manage the Developer Center, or the token lacks the required scope.

- `errors` (list of ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail.

### 404 Not Found Error

Not Found. No token with this id exists, or it belongs to someone else.

- `errors` (list of ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail.

### 429 Too Many Requests Error

Too Many Requests. The rate limit has been exceeded.

- `errors` (list of ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail.

### 500 Internal Server Error

Internal Server Error. An unexpected error occurred.

- `errors` (list of ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail.

## Types

### ApiTokensTokenIdInvalidatePostRequestBodyContentApplicationJsonSchemaData

Details of the invalidation.

- `reason` (string, optional) — Reason shown next to the invalidated token in the Developer Center.

### ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaData

- `id` (string, required) — Unique identifier of the API token.
- `status` (enum, required) — The token no longer authenticates: `INVALIDATED`, or `EXPIRED` when it had already expired and was left unchanged.
  - Allowed values: `INVALIDATED`, `EXPIRED`

### ApiTokensTokenIdInvalidatePostResponsesContentApplicationJsonSchemaErrorsItems

- `code` (string, required) — Machine-readable error code.
- `message` (string, required) — Human-readable description of the error.

## Examples

**Request**

```json
{}
```

**Response**

```json
{
  "data": {
    "id": "7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51",
    "status": "INVALIDATED"
  }
}
```

**SDK Code**

```python
import requests

url = "https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51/invalidate"

payload = {}
headers = {
    "X-Beta": "true",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51/invalidate';
const options = {
  method: 'POST',
  headers: {
    'X-Beta': 'true',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: '{}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51/invalidate"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Beta", "true")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51/invalidate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Beta"] = 'true'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51/invalidate")
  .header("X-Beta", "true")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51/invalidate', [
  'body' => '{}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
    'X-Beta' => 'true',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51/invalidate");
var request = new RestRequest(Method.POST);
request.AddHeader("X-Beta", "true");
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "X-Beta": "true",
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = [] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51/invalidate")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```