Revoke user consent for a specific scheme token to prevent future use.
Revoke works only when consent was saved with the scheme token. When you create the token, include optional customerConsent with hasCustomerConsent, merchantId, and merchantShopperId. If you skip that step (e.g., in a recurring payment flow), this endpoint returns 404 because there's nothing to revoke.
Use the following request to revoke user consent for a scheme token.
curl -i -X DELETE \
https://api-services.pxp.io/api/v1/token-vault/merchantgroup/fcc/vaults/scheme-tokens/ee18cb07-5855-46a0-85af-a3f86a9e3a1b/user-consents/MERCHANT-001/6152 \
-H 'Content-Type: application/json'| Parameter | Description |
|---|---|
ownerTypestring (enum) required | The type of entity that owns the token vault. Use with ownerId to identify which vault to use.Possible values:
|
ownerIdstring (0 to 20 characters) required | The identifier of the vault owner. This must match the owner type. For example, provide your merchant group ID when ownerType is MerchantGroup. |
schemeTokenIdstring (UUID) required | The scheme token ID. It must belong to the vault for this ownerType and ownerId. |
merchantIdstring required | The merchant identifier associated with the consent. Use the same value you stored in customerConsent when you created the token. |
merchantShopperIdstring required | Your unique identifier for the shopper. Use the same value you stored in customerConsent when you created the token. Matching is case-sensitive and doesn't ignore spaces. |
If your request is successful, you'll receive a 204 response with no content. This confirms that consent has been revoked and the token can't be used for future transactions until consent is granted again.
If you receive a 404, no matching consent was found. Check the following:
- Consent was stored when the token was created (
customerConsenton create). merchantIdandmerchantShopperIdmatch the stored values exactly, including case and spaces formerchantShopperId.schemeTokenIdbelongs to the vault for the sameownerTypeandownerIdin the URL.