Revoke a bundle link
const url = 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/bundles/2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64/links/5d2c8e71-3f4a-4b90-8c16-e7a9d0b2f345/revoke';const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/bundles/2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64/links/5d2c8e71-3f4a-4b90-8c16-e7a9d0b2f345/revoke \ --header 'Authorization: Bearer <token>'Revokes a link permanently, whatever the bundle’s status, so a leaked link stops working. It can’t be restored. Safe to retry: revoking a revoked link changes nothing.
Required permissions
- None beyond a valid token; requires an OAuth token with the
developerorbundlesscope, for an owner of the addressed organization or a member with thebundlesfinance area and all apps
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the organization that owns the bundles, as listed by GET /me under organizations.
Example
9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7bUnique id (UUID) of the organization that owns the bundles, as listed by GET /me under organizations.
Unique id (UUID) of the bundle, as returned by the create and list operations.
Example
2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64Unique id (UUID) of the bundle, as returned by the create and list operations.
Unique id (UUID) of the link, as returned by the create and list operations.
Example
5d2c8e71-3f4a-4b90-8c16-e7a9d0b2f345Unique id (UUID) of the link, as returned by the create and list operations.
Responses
Section titled “Responses”The revoked link.
object
A link that offers a private bundle to whoever holds it.
object
Server-assigned unique id of the link.
Id of the bundle the link belongs to.
What the developer calls the link.
The token in the link’s URL. It stays readable, so the link can be copied again at any time.
The URL to send to a team.
How many teams have bought through the link.
When the link was revoked, as an ISO 8601 UTC timestamp. Null while it is not revoked.
Id of the user who created the link. Null once that user is deleted.
When the link was created, as an ISO 8601 UTC timestamp.
Example
{ "link": { "linkId": "5d2c8e71-3f4a-4b90-8c16-e7a9d0b2f345", "bundleId": "2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64", "label": "Acme partner offer", "limit": 25, "token": "3f9a1c7e5b2d4806a1e3c5f7092b4d6e8f0a1c3e5b7d9f1a2c4e6b8d0f2a4c6e", "url": "https://platform.blotout.io/bundles/link?token=3f9a1c7e5b2d4806a1e3c5f7092b4d6e8f0a1c3e5b7d9f1a2c4e6b8d0f2a4c6e", "useCount": 0, "revokedAt": "2026-11-05T00:00:00.000Z", "createdByUserId": "c7d1e2f3-4a5b-4c6d-8e9f-0a1b2c3d4e5f", "createdAt": "2026-11-05T00:00:00.000Z" }}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known. bundles_scope_required — The bearer credential has neither the developer nor the bundles scope, so it reaches no bundle operation whatever the role of its user. Authorize again to get a token with one of them.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}not_found — The addressed resource does not exist within this team; check the id and retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "not_found"}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}