Ks Tan (Asia Vad) asked a question.
Revoke of API Token
After generation of token, is there a way to revoke it? or clear all the current active tokens?
I understand for MOVEit, there is, see ref: https://docs.ipswitch.com/MOVEit/Automation2024/API/REST-API/index.html#_revoketokenusingpost, but can't find similar in WhatsUp Gold REST API document.
Thanks.
I don't think you can revoke it, just let it time out.
where is it stored so we can create our workarond to clear it?
I can't find it in database, and any local file yet.
I understand access token expires in 30 minutes, and refresh token expires after 35 days.
I may be wrong, but I think it is stored in memory.
A few experiment I did -
1) I reboot WhatsUp server, the token is still working => so I suspect it's not in RAM memory
2) I restore the DB before the token is generated, the token is stil working => so it's not store at DB.
So I suspect it's i in some local file or registry, which I am not able to pinpoint yet to find a workaround to revoke it.
I asked the entire team and will report back when I get an answer. I would add a feature request to add a Revoke Token end point.
They said there is no way to revoke it and it is not stored. it is all in the token you send, as long as it is still not expired it will work. You can go to the NmApiServer.exe.user.config (back it up first) and edit the api:jwtAccessTokenTTLSecs and set the timeout lower. The default is like 30 min
Thanks Mike for the sharing of config file and feature request.
With the sharing of this NmApiServer.exe.user.config, I also found the 2nd token, i.e. refresh token, valid for 35 days (3024000 seconds). Further test show that update of these values affect only newly created token, but not previous token, created under default and older expiry date.