# Revoke scheme token consent

Revoke user consent for a specific scheme token to prevent future use.

## Before you start

Revoke works only when consent was saved with the scheme token. When you [create the token](/guides/token-vault), include optional `customerConsent` with `hasCustomerConsent`, `merchantId`, and `merchantShopperId`. If you skip that step (e.g., in a recurring payment flow), this endpoint returns `404` because there's nothing to revoke.

## Revoke consent for a scheme token

/token-vault/{ownerType}/{ownerId}/vaults/scheme-tokens/{schemeTokenId}/user-consents/{merchantShopperId}

### Request example

Use the following request to revoke user consent for a scheme token. The merchant comes from your authentication, so it isn't a path parameter.

```shell
curl -i -X DELETE \
  https://api-services.pxp.io/api/v1/token-vault/merchantgroup/fcc/vaults/scheme-tokens/ee18cb07-5855-46a0-85af-a3f86a9e3a1b/user-consents/6152 \
  -H 'Content-Type: application/json'
```

#### Path parameters

| Parameter | Description |
|  --- | --- |
| `ownerType`string (enum) | The type of entity that owns the token vault. Use with `ownerId` to identify which vault to use.Possible values:`Referrer``MerchantGroup``Merchant``Site` |
| `ownerId`string (0 to 20 characters) | The identifier of the vault owner. This must match the owner type. For example, provide your merchant group ID when `ownerType` is `MerchantGroup`. |
| `schemeTokenId`string (UUID) | The scheme token ID. It must belong to the vault for this `ownerType` and `ownerId`. |
| `merchantShopperId`string | Your unique identifier for the shopper. Use the same value you stored in `customerConsent` when you created the token. Matching is case-sensitive and doesn't ignore spaces. |


### Response example

If your request is successful, you'll receive a `204` response with no content. This confirms that consent has been revoked and the token can't be used for future transactions until consent is granted again.

If you receive a `404`, no matching consent was found. Check the following:

- Consent was stored when the token was created (`customerConsent` on create).
- `merchantShopperId` matches the stored value exactly, including case and spaces.
- `schemeTokenId` belongs to the vault for the same `ownerType` and `ownerId` in the URL.