Revoke a personal access token
Revokes the token with the given ID. Idempotent: revoking an already-revoked token succeeds. PAT callers need `write` scope; revoking the token that authenticates the request itself additionally requires X-Routess-Confirm: true, since it locks the caller out.
AuthorizationBearer <token>Personal access token for non-browser clients. Mint at Settings → API Tokens. Carries one of two scopes: read (list/get Routes, export GPX, profile) or write (read plus metadata-only mutations on owned routes and on preferences). Blocked from /admin/* and from DELETE /users/me. Destructive operations require X-Routess-Confirm: true and return 428 PRECONDITION_REQUIRED otherwise. See ADR-0022 and ADR-0023.
id*numberToken ID
X-Routess-Confirm?stringRequired as true when a PAT revokes itself. Cookie sessions ignore this header.
Token revoked
application/json- response
success*booleancurl -X DELETE 'https://api.routess.com/auth/tokens/0'{ "success": true}Mint a personal access token
Creates a new PAT for the authenticated user. Returns the plaintext exactly once; it is hashed at rest and cannot be retrieved again. Tokens authenticate non-browser clients (CLI, AI agents, scripts) via `Authorization: Bearer routess_pat_…`. Minting is cookie-only: PATs cannot mint other PATs. PATs are blocked from `/v1/admin/*` and from `DELETE /v1/users/me` regardless of the owner's role.
List active sessions
Returns all active sessions for the authenticated user. The session that issued the current JWT is marked with isCurrent=true.