Skip to main content

Revoke-ZrToken

Adds an issued token — or all tokens for a subject — to the revocation deny-list, fanning the revocation out to every connected manager so the tokens are rejected cluster-wide.

Syntax​

Revoke-ZrToken
    [-TokenId <string>]
    [-Subject <string>]
    [-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
    [-WhatIf] [-Confirm]

Description​

Revoke-ZrToken deny-lists a previously issued token so it can no longer be used, even before it expires. Deny-list a single token by its identifier (-TokenId, the jti shown when the token was issued by New-ZrToken), or every token held by an identity with -Subject. The revocation fans out to all resolved managers so the tokens are rejected cluster-wide. Specify either -TokenId or -Subject; if neither is given the cmdlet reports that one is required. Requires an active workspace or an explicit -Managers list and an admin token.

warning

This is a state-changing operation. Revoking by -Subject invalidates every token that identity currently holds — any application still using one of those tokens will start failing authentication immediately. Confirm you are targeting the right token id or subject before running it.

Parameters​

ParameterTypeRequiredDescription
-TokenIdstringNoThe identifier (jti) of a single token to revoke. Supply this or -Subject.
-SubjectstringNoThe subject whose tokens are all revoked. Used when -TokenId is not supplied.
-Managersstring[]NoManagement Service endpoints (host, host:port, or URL) to target. When omitted, the active workspace's managers are used.
-PortintNoManagement Service port for bare-host managers. Default 7801.
-TokenstringNoAdmin bearer token for authenticated control-plane calls.
-TimeoutSecintNoPer-request timeout in seconds. Default 30.

Supports -WhatIf and -Confirm.

Examples​

Deny-list the single token whose id (jti) is shown below, on all managers.

Revoke-ZrToken -TokenId a1b2c3d4

Deny-list every token issued to the subject app1.

Revoke-ZrToken -Subject app1