An admin with the user:manage permission revokes a user's API tokens in Administration, or with DELETE /api/users/:id/tokens. Revoke when a token leaks or a person leaves. Then create a fresh token and update every pipeline secret that used the old one.
Steps
- Use an account that holds
user:manage, such as a SuperAdmin. - Open Administration, go to Users and find the person.
- Look at their tokens. In the API,
GET /api/users/:id/tokenslists them. - Revoke them. The API call is
DELETE /api/users/:id/tokens, which revokes the user's API tokens. - If the person still needs access, create a new token. Read what to do about a lost token for the one-time display rule.
- Replace
CYBERLOP_API_TOKENin your repository or CI settings with the new value.
We did not review the Administration screens, so button names may differ. The calls above come from the API Reference.
Good to know
Revoke at once if a token leaks, shows up in a log, or belongs to someone who has left. Once you revoke it, any call that carries the old value stops working, which means a CI job that still uses it will fail until you update its secret with a fresh one.
| Call | Purpose |
|---|---|
GET /api/users/:id/tokens | List a user's API tokens |
POST /api/users/:id/tokens | Create or regenerate a token, with the raw secret shown once |
DELETE /api/users/:id/tokens | Revoke the user's tokens |
- All three need the
user:managepermission. - Removing a person entirely is a separate step. See how to remove a user.
- Did a token quietly stop working? Someone may have revoked it. See why a token stopped working.
A token is only as safe as the place that stores it. Questions? Use the contact page.
Related questions
- I lost my API token. Can I see it again?
- My API token suddenly stopped working. Why?
- How do I remove a user from my workspace?
- How do I get a personal API token?
- Which secrets do I need to add to my repository for CI scans?
Cyberlop API tokens and permissions: how to issue and limit them
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.