Do API tokens still remain active for deactivated users?

Question

I have a user who was deactivated a while ago. They still have an API token (although it's unused) - but my question is twofold

- Can the API token still be used by the user?

- How do I deactivate the token if I don't have an Atlassian Access subscription?

John Funk · Answer

Very good - thank you for the information Hrish!

unknown · Answer

@John Funk I got a response from Atlassian support in my email - here it is.

--------------------------------------------------

The API Token is a string that is tied (connected) to an account. As long as that account has access to the Jira/Confluence site, the API Token will continue to work, since there is no expiry date.

* * However, when you remove site access (or application access) for an account, that API token will no longer work in operations (REST API calls) against that specific site or application where the user no longer has access.

* Unfortunately, revoking a user's API Token is only available if you have an Atlassian Access subscription.

John Funk · Answer

Hi @[deleted] - Did you ever get an answer for this?