Revoke Account Access

curl --request POST \
  --url https://api.atoa.me/api/bank/auth/revoke \
  --header 'Authorization: Bearer <token>'

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.atoa.me/api/bank/auth/revoke', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/bank/auth/revoke",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.atoa.me/api/bank/auth/revoke"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.atoa.me/api/bank/auth/revoke")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "Consent successfully revoked for the specified account",
  "revokedDetails": {
    "accountId": "account-id-example"
  }
}

{
  "success": true,
  "message": "Consent successfully revoked for all specified accounts",
  "revokedDetails": {
    "accountIds": [
      {
        "id": "account-id-1",
        "status": "success"
      },
      {
        "id": "account-id-2",
        "status": "success"
      }
    ]
  }
}

{
  "success": false,
  "message": "Consent revocation completed with 1 successes and 1 failures",
  "revokedDetails": {
    "accountIds": [
      {
        "id": "account-id-1",
        "status": "success"
      },
      {
        "id": "account-id-2",
        "status": "failed",
        "error": "Consent not found"
      }
    ]
  }
}

{
  "success": true,
  "message": "Consent successfully revoked for the specified reference",
  "revokedDetails": {
    "accountAuthId": "auth-id-example"
  }
}

{
  "name": "BAD_REQUEST",
  "message": "Only one parameter can be provided: accountId, accountIds, or accountAuthId. Multiple parameters are not allowed.",
  "status": 400,
  "errors": "[]"
}

{
  "name": "UNAUTHORIZED",
  "message": "Unauthorized",
  "status": 401,
  "errors": "[]"
}

{
  "name": "NOT FOUND",
  "message": "Consent not found",
  "status": 404,
  "errors": "[]"
}

POST

api

bank

auth

revoke

Revoke Account Access

curl --request POST \
  --url https://api.atoa.me/api/bank/auth/revoke \
  --header 'Authorization: Bearer <token>'

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.atoa.me/api/bank/auth/revoke', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/bank/auth/revoke",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.atoa.me/api/bank/auth/revoke"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.atoa.me/api/bank/auth/revoke")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "Consent successfully revoked for the specified account",
  "revokedDetails": {
    "accountId": "account-id-example"
  }
}

{
  "success": true,
  "message": "Consent successfully revoked for all specified accounts",
  "revokedDetails": {
    "accountIds": [
      {
        "id": "account-id-1",
        "status": "success"
      },
      {
        "id": "account-id-2",
        "status": "success"
      }
    ]
  }
}

{
  "success": false,
  "message": "Consent revocation completed with 1 successes and 1 failures",
  "revokedDetails": {
    "accountIds": [
      {
        "id": "account-id-1",
        "status": "success"
      },
      {
        "id": "account-id-2",
        "status": "failed",
        "error": "Consent not found"
      }
    ]
  }
}

{
  "success": true,
  "message": "Consent successfully revoked for the specified reference",
  "revokedDetails": {
    "accountAuthId": "auth-id-example"
  }
}

{
  "name": "BAD_REQUEST",
  "message": "Only one parameter can be provided: accountId, accountIds, or accountAuthId. Multiple parameters are not allowed.",
  "status": 400,
  "errors": "[]"
}

{
  "name": "UNAUTHORIZED",
  "message": "Unauthorized",
  "status": 401,
  "errors": "[]"
}

{
  "name": "NOT FOUND",
  "message": "Consent not found",
  "status": 404,
  "errors": "[]"
}

Revoke bank account access for a specific account, multiple accounts, or using an account authorization ID.

Authorization

Bearer <token> Request Body Schema

string

ID of the user’s bank account. This can be obtained from the redirect URL after account linking or by using the Fetch All Accounts API Reference endpoint.Refer:- Accounts

string

Account authorization ID to revoke access for.

string

Comma-separated list of account IDs to revoke access for (e.g., “id1,id2,id3”). This can be obtained from the redirect URL after account linking or by using the Fetch All Accounts API Reference endpoint.Refer:- Accounts

Note: Only one parameter can be provided: accountId, accountIds, or accountAuthId. Multiple parameters are not allowed.

All consents are valid for 90 days.
If auto-renew is enabled, we will attempt background renewal before expiry.
Once expired, any call to transactions or account endpoints will return: 404 Consent not found

🧠 Recommendation: Prompt users to re-authenticate as consent expiration nears (e.g., 7 days before expiry).

{
  "success": true,
  "message": "Consent successfully revoked for the specified account",
  "revokedDetails": {
    "accountId": "account-id-example"
  }
}

{
  "success": true,
  "message": "Consent successfully revoked for all specified accounts",
  "revokedDetails": {
    "accountIds": [
      {
        "id": "account-id-1",
        "status": "success"
      },
      {
        "id": "account-id-2",
        "status": "success"
      }
    ]
  }
}

{
  "success": false,
  "message": "Consent revocation completed with 1 successes and 1 failures",
  "revokedDetails": {
    "accountIds": [
      {
        "id": "account-id-1",
        "status": "success"
      },
      {
        "id": "account-id-2",
        "status": "failed",
        "error": "Consent not found"
      }
    ]
  }
}

{
  "success": true,
  "message": "Consent successfully revoked for the specified reference",
  "revokedDetails": {
    "accountAuthId": "auth-id-example"
  }
}

{
  "name": "BAD_REQUEST",
  "message": "Only one parameter can be provided: accountId, accountIds, or accountAuthId. Multiple parameters are not allowed.",
  "status": 400,
  "errors": "[]"
}

{
  "name": "UNAUTHORIZED",
  "message": "Unauthorized",
  "status": 401,
  "errors": "[]"
}

{
  "name": "NOT FOUND",
  "message": "Consent not found",
  "status": 404,
  "errors": "[]"
}

Overview

Reference

Webhook

Card on File

Revoke Account Access

Authorization

​Authorization

​Consent Lifecycle & Expiry

Authorization

Consent Lifecycle & Expiry