Skip to content
Docs

Revoke an API token

DELETE
/api/workspaces/{ws}/api-tokens/{id}

Your own; owners and admins can revoke anyone's. It stops working at once.

Authorization

session
cookiebetter-auth.session_token<token>

Set by POST /api/auth/sign-in/email.

Path Parameters

ws*string

The workspace id (from GET /api/me).

id*string

The id of what the path names: a hire, a connection, a skill, a shared file, a department, a position, a goal or an approval.

Response Body

Done; no body.

Example Request
curl -X DELETE 'https://app.useroster.work/api/workspaces/string/api-tokens/string'
Example Response
Empty

Make an API token POST

The token acts as you, with your role in this workspace as it is at each call, in this workspace only. It's shown once, in `token`; Roster keeps only a hash. Made in the app only, never by an agent.

Roster's MCP server POST

Model Context Protocol over Streamable HTTP, for Claude Code, Codex and other agents: send JSON-RPC (`initialize`, `tools/list`, `tools/call`) with `Authorization: Bearer <API token>`. Answers are JSON; there are no sessions. The tools do what you can do in the app, with your rights, and nothing more. See the guide "Use Roster from Claude Code, Codex or another agent".