DELETE
/
api
/
v1
/
me
/
push-tokens
/
:token
Unregister push token
curl --request DELETE \
  --url https://api.example.com/api/v1/me/push-tokens/:token
import requests

url = "https://api.example.com/api/v1/me/push-tokens/:token"

response = requests.delete(url)

print(response.text)
const options = {method: 'DELETE'};

fetch('https://api.example.com/api/v1/me/push-tokens/:token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/me/push-tokens/:token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "DELETE",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/me/push-tokens/:token"

req, _ := http.NewRequest("DELETE", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.delete("https://api.example.com/api/v1/me/push-tokens/:token")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/me/push-tokens/:token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Delete.new(url)

response = http.request(request)
puts response.read_body

Overview

The client calls this on:
  • Sign-out — to stop sending push to a device that’s no longer logged in.
  • Notification permission revoked — to keep the server-side record in sync with the device.
  • App uninstall preflight — best-effort only; FCM 410-GONE cleanup (see Push notification fan-out) is the real safety net.
Removing a token that is not on the user’s record returns 200 { removed: false } rather than 404. This is intentional: the client should not have to track whether a given token is currently registered.

Authentication

Bearer <accessToken> required. requireAuth + requireOnboarded middleware applied.

Path parameters

NameTypeRequiredNotesExample
tokenstringyesThe FCM registration token to remove. URL-encode it (FCM tokens contain : and other reserved chars).fcm_eYqJ...VeryLongFCMRegistrationToken...

Query parameters

None.

Request body

None.

Response — 200 OK

FieldTypeNotesExample
removedbooleantrue iff the token was present and is now gone. false if the token was not on the user’s record (idempotent no-op).true
{ "removed": true }
Idempotent no-op:
{ "removed": false }

Side effects

  • On removed: true: the (token) entry is pulled from the user’s pushTokens array.
  • On removed: false: no mutation.

Error responses

StatusCodeMeaning
400VALIDATION_FAILED:token path parameter was empty after URL-decoding.
401UNAUTHENTICATEDMissing, malformed, or expired access token.
403ONBOARDING_INCOMPLETECaller has not finished onboarding.

See also

curl

curl -X DELETE \
  "https://api.swappr.co.uk/api/v1/me/push-tokens/$(python3 -c 'import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1],safe=""))' "$TOKEN")" \
  -H "Authorization: Bearer $ACCESS_TOKEN"