Allow only tokens with the delete scope

DELETEhttps://api.testingapis.com/api/auth/roles/resourceSign in to see this endpoint's URL

Header: Authorization: Bearer <token>. Only admin-token has the delete scope; user-token and readonly-token get 403.

Bearer token — admin-token

Responses

200: Token has the delete scope.
401: Token missing or not one of the test tokens.
403: Valid token without the delete scope.

Example

Request

curl -X DELETE "https://api.testingapis.com/api/auth/roles/resource" \
  -H "Authorization: Bearer admin-token" \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{
  "authorized": true,
  "user": "Alice Admin",
  "roles": ["admin", "user"],
  "scopes": ["read", "write", "delete"]
}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl -X DELETE 'https://api.testingapis.com/api/auth/roles/resource' \
  -H 'Authorization: Bearer admin-token' \
  -H 'X-TestingApis-Key: YOUR_API_KEY'

const res = await fetch("https://api.testingapis.com/api/auth/roles/resource", {
  method: "DELETE",
  headers: {
    "Authorization": "Bearer admin-token",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
console.log(res.status, await res.text());

// The shape of the example response in the docs.
type ApiResponse = {
  authorized: boolean;
  user: string;
  roles: string[];
  scopes: string[];
};

const res = await fetch("https://api.testingapis.com/api/auth/roles/resource", {
  method: "DELETE",
  headers: {
    "Authorization": "Bearer admin-token",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
const body = (await res.json()) as ApiResponse;
console.log(res.status, body);

import requests

res = requests.delete(
    "https://api.testingapis.com/api/auth/roles/resource",
    headers={
        "Authorization": "Bearer admin-token",
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
)
print(res.status_code, res.text)

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Delete, "https://api.testingapis.com/api/auth/roles/resource");
request.Headers.TryAddWithoutValidation("Authorization", "Bearer admin-token");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/roles/resource"))
                .header("Authorization", "Bearer admin-token")
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .DELETE()
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("DELETE", "https://api.testingapis.com/api/auth/roles/resource", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer admin-token")
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}