ARTIFACTORY: How to Revoke All Access Tokens for a Specific User in Artifactory

Introduction 
This article describes how to revoke all access tokens associated with a specific user in Artifactory. The process involves retrieving all tokens from the system, filtering those that belong to the target user, and then revoking them.

Resolution 

1. Retrieve All Tokens and Filter by User:

Use the Get Tokens API to retrieve all access tokens from the environment. 
The following command filters the tokens that belong to a specific user and saves the results to a file named userTokens.json.

curl '<ARTIFACTORY_URL>/access/api/v1/tokens' \
--header 'Authorization: Bearer <ADMIN_TOKEN>' | jq '.tokens | map(select(.subject | endswith("/users/<USER_NAME>")))' > userTokens.json

2. Review the Retrieved Tokens
Before proceeding, review the contents of userTokens.json to confirm that the tokens listed belong to the intended user.

Important

Once tokens are revoked, they cannot be restored. Ensure that only the desired tokens are included before continuing.


3. Revoke the Tokens
To revoke the tokens, create a script that iterates through the list of token IDs obtained in the previous step and calls the Revoke Token by ID API for each token.

Example script:

#!/bin/bash

jq -r '.[].token_id' userTokens.json | while read -r TOKEN_ID; do
  echo "Revoking token ID: $TOKEN_ID"
  
  curl -s  --request DELETE "<ARTIFACTORY_URL>/access/api/v1/tokens/$TOKEN_ID" \
  --header 'Authorization: Bearer <ADMIN_TOKEN>'
  
  echo -e "\n---"
done

This script performs the following actions:

1. Extracts the token_id values from userTokens.json that was generated in Step 1.
   
2. Iterates through each token ID.
   
3. Sends a DELETE request to revoke each token using the Revoke Token by ID API.

** This script is provided as an example and may be modified according to your requirements. Kindly review it carefully before proceeding with the deletion, as once the tokens are deleted, they cannot be restored.