# Delivery Access Token A *DeliveryAccessToken* is a read-only token used to read published content from the CDA (public delivery). When a website or app's browser fetches published content, it calls the CDA with this token. At issue time it is bound to a single *SpaceRole*, and that role determines the token's read scope (which *Content Type*s it can read). In CMA, a *DeliveryAccessToken* is a sub-resource of *Space*, and its path is based on `/spaces/{spaceId}/delivery-access-tokens`. Because this token operates while exposed to the browser (client), the role you bind to it must be a least-privilege role that reads only the *Content Type*s you actually need (see [Security: least-privilege binding](#security-least-privilege-binding) below). On top of that, if you put the origins allowed to make calls into `allowedReferrers`, this token cannot be used outside the sites you listed (see [Origin notation rules](#allowed-referrers-format) and [Referer enforcement](#referrer-enforcement)). ## Resource structure {#resource-structure} The following is the response when a *DeliveryAccessToken* is created. The token value and scope live in `sys` (system properties), while `name`, `description`, and `allowedReferrers` are body properties. ```json { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGndFQrblq", "type": "DeliveryAccessToken", "space": { "sys": { "id": "tcq4V2Xb", "type": "Refer", "targetType": "Space" } }, "user": { "sys": { "id": "3trmXRLdJIqc9GPBbyFYQQw6hf9kGj", "type": "Refer", "targetType": "User" } }, "createdBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "createdAt": "2026-06-18T09:25:32.624Z", "updatedBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "updatedAt": "2026-06-18T09:25:32.624Z", "accessToken": "DVRATbQ8mX2vK9pLs7Rf1Zt0Nc4Wd6Hg5Ua2Ee9Ck3PoYx8Bj6Hg5Ua2Ee9Ck3Po…", "scopes": ["DELIVERY_ACCESS_TOKEN"] }, "allowedReferrers": ["https://shop.example.com"], "description": "Read-only delivery token for the clothing store public site", "name": "Public website delivery" } ``` Key properties: - `sys.id`: The unique identifier of the *DeliveryAccessToken*. It goes into `{deliveryAccessTokenId}` in the single-read, update, and delete paths. - `sys.accessToken`: The secret token value used to call the CDA. The same value is returned on subsequent reads after issuance, so handle it with care (see the security section below). - `sys.scopes`: The token's permission scope. A *DeliveryAccessToken* is always `["DELIVERY_ACCESS_TOKEN"]` at issue time. - `sys.user`: The dedicated user that is the authority subject of this token. It is created automatically at issue time, and the permissions of the bound *SpaceRole* are granted to this user. In other words, the token's effective permissions come from this user. It is a different user from the person who actually issued the token (`sys.createdBy`). - `name`: The token name you specify on creation (e.g. `Public website delivery`). - `description`: A description of the token (optional). - `allowedReferrers`: The list that restricts which origins may call this token. An empty list applies no restriction. The token in the example above passes only when it is called from the clothing store's public site (`https://shop.example.com`) (for the notation rules and how the list is checked, see [Origin notation rules](#allowed-referrers-format) and [Referer enforcement](#referrer-enforcement)). The `accessToken` in the example above is a secret value, so it is replaced with an example string. In reality it is a long, opaque string, and reading it again after issuance returns the same value. ## System properties (sys) {#system-properties-sys} Every *DeliveryAccessToken* carries common system properties and token-specific properties in the `sys` object. `space`, `user`, `createdBy`, and `updatedBy` are in the `Refer` shape (`{ "sys": { "id", "type": "Refer", "targetType" } }`). | Property | Type | Description | |---|---|---| | `id` | string | Unique resource identifier. | | `type` | string | Resource kind. For a *DeliveryAccessToken* this is always `"DeliveryAccessToken"`. | | `space` | Refer<Space> | The *Space* this token belongs to. | | `user` | Refer<User> | The dedicated user that is the authority subject of this token. Created automatically at issue time, and the permissions of the bound *SpaceRole* are granted to this user (the token's effective permissions come from this user). It is a different user from `createdBy` (the actual issuer). | | `createdBy` | Refer<User> | The actual user who issued this token (the authority subject is `user` above). | | `createdAt` | string (date-time) | Creation time. | | `updatedBy` | Refer<User> | The actual user who last updated it. | | `updatedAt` | string (date-time) | Last update time. | | `accessToken` | string | The secret token value used to call the CDA. **Since it is returned as-is on reads after issuance,** handle it so it is not exposed externally. | | `scopes` | string array | The token's permission scope. A *DeliveryAccessToken* is always `["DELIVERY_ACCESS_TOKEN"]`. | Body properties: | Property | Type | Description | |---|---|---| | `name` | string (1-64) | Token name. Specified on creation. | | `description` | string (≤128) | Token description. Optional. | | `allowedReferrers` | string array (0-50) | The list of origins allowed to call this token. An empty list means no restriction. A full update replaces the whole body, so leaving this property out empties the list and lifts the restriction. To keep the restriction as it is, send the current list again. You can change it after issuance. | ## Security: least-privilege binding {#security-least-privilege-binding} A *DeliveryAccessToken* calls the CDA while exposed to the browser and to visitors. Because of this, which *SpaceRole* you bind it to is exactly what defines the token's security boundary. - In the create request's `role`, put the `sys.id` of a **least-privilege *SpaceRole* that reads only the *Content Type*s you need**. A read-only role is recommended for public delivery. - **Never bind the `Administrator` role.** Since this token is exposed to the client, binding a role that carries management privileges leaks those privileges externally as-is. Also, do not absentmindedly use the first item in the *SpaceRole* list; explicitly specify the `sys.id` of the intended least-privilege role. - **Tie down where this token may be used as well, with `allowedReferrers`.** The bound role determines what you can read with this token, and this list determines where it can be called from. A token that runs in the browser cannot hide its own value, so once you put your public site's origin in the list, a CDA call from outside that site does not pass even if the token value leaks (see [Referer enforcement](#referrer-enforcement)). - `accessToken` is a secret value that is returned with the same value on reads after issuance. Inject it safely into the client build, but do not expose it externally as-is. ## Status and constraints {#status-and-constraints} The value constraints observed on creation and update. | Target | Constraint | |---|---| | `name` | 1-64 characters, required (on creation). | | `description` | 128 characters or fewer, optional. | | `role` | The `Refer` of a *SpaceRole*, required (on creation). | | `allowedReferrers` | 0-50 items. Each item must follow the [Origin notation rules](#allowed-referrers-format) below. | Rules about binding and permissions: - The `role` you bind must actually exist in that *Space*. Putting the `sys.id` of a role that is not in that *Space* gets the creation rejected. - A caller can bind **only a role they themselves hold in that *Space*.** This constraint prevents granting a token higher privileges by binding a role the caller does not have; a create request that breaks it is rejected. However, an administrator of that *Space* (a holder of the Administrator role) is not subject to this constraint and can bind any role. - A *DeliveryAccessToken* is a count-limited resource. Exceeding your current plan's issuance count limit gets the creation rejected. For per-plan limits, see [Pricing](/pricing/pricing.md). - Issuing and managing (create, read, update, delete) requires `SETTING_DELIVERY_ACCESS_TOKEN` in the `settings` of the caller's role. It is a separate action from `SETTING_SPACE_ACCESS_TOKEN`, which issues a [Space Access Token](/api/reference/cma/space-access-token.md) that can also write, so you can grant only the permission to issue delivery tokens and block the issuance of write tokens (see [SpaceRole](/api/reference/cma/space-role.md#settings-space-settings-access)). - This API is called only with a console login session or a *Personal Access Token*. An issued *DeliveryAccessToken* cannot create another *DeliveryAccessToken*. ### Origin notation rules {#allowed-referrers-format} Each item in `allowedReferrers` is a string that points to one origin allowed to make calls. Write it in the following shape. ```json "allowedReferrers": [ "https://shop.example.com", "https://*.shop.example.com", "http://localhost:3000" ] ``` The list holds up to 50 items, and you cannot put the same origin in it twice. Each item must follow these rules. - Use only `https` as the scheme. `http` is allowed only for `localhost`, `127.0.0.1`, and `[::1]`. - Use a wildcard only as a single leading `*.` label. You cannot use one in the path. - Write the host in ASCII. Enter an internationalized domain in Punycode notation. - The port ranges from 1 to 65535. If you omit it, the scheme's default port applies (443 for `https`, 80 for `http`). - If you write a path, a request passes only when its path is exactly the same. The browser sends the path percent-encoded, so use only ASCII in the path. - An item that carries user info (`user@`), a query (`?`), or a fragment (`#`) is rejected. This check applies on all three paths: create, full update, and partial update. If even one item breaks the rules, the list is not saved and the request is rejected, and one offending item is reported in the error reason (see [Errors](#errors)). ### Referer enforcement {#referrer-enforcement} Once the token is issued, every CDA call you make with it is checked against `allowedReferrers` to decide whether it passes. - An empty list applies no restriction. A call from any origin passes. - If the list holds even one item, the check reads the request's `Referer` header value. The `Origin` header is not consulted. - A request whose `Referer` header is missing or empty is rejected. The browser sends this header on its own, but for a token to be used where `Referer` is not sent, such as a build script running on a server or server-side rendering, leave the list empty. - To pass, the scheme, host, and port of the `Referer` must all match one item in the list. If that item carries a path, the path must match as well. - `https://*.shop.example.com` covers every host that ends in `.shop.example.com`, such as `admin.shop.example.com`, and does not cover `shop.example.com` itself. To allow both, add `https://shop.example.com` as one more item. - This check applies to every request you send with this token. It is the same whichever CDA path you call. - A request that fails the check is rejected with HTTP `403`. The code it returns is in [Errors](#errors) below. ## Errors {#errors} These are the codes you meet when working with a *DeliveryAccessToken*. For codes that are common to every resource, see [common errors](/api/reference/common/errors.md). | Code | Condition | |---|---| | `WGL400071` | You put an item into `allowedReferrers` that breaks the [Origin notation rules](#allowed-referrers-format). The list is checked on create, full update, and partial update alike. | | `WGL404001` | The `role` carries the `sys.id` of a *SpaceRole* that does not exist in that *Space*. | | `WGL422001` | The caller tried to bind to the token a *SpaceRole* that the caller does not hold in that *Space*. An administrator of that *Space* (a holder of the Administrator role) is not subject to this restriction. | | `WGL429001` | A new token was requested while the number of issued *DeliveryAccessToken*s had already reached the current plan's limit. | | `WGL403001` | The caller's role does not have the `SETTING_DELIVERY_ACCESS_TOKEN` settings permission. That permission is needed not only to issue a *DeliveryAccessToken*, but also to read, update, and delete one. | | `WEB403001` | A caller used a token that specifies `allowedReferrers` from an origin that is not in the list, or the request carried no `Referer`. This code comes back when you make a request with the token, not when you manage the token. | ## API {#api} The base URL for all endpoints below is `https://cma.weegloo.com/v1`, and a Bearer token that authenticates against CMA is required in the `Authorization` header. Updating and partially updating a *DeliveryAccessToken* does not require the `X-Weegloo-Version` header. ```api-endpoint { "title": "List Delivery Access Tokens", "method": "GET", "path": "/spaces/{spaceId}/delivery-access-tokens", "description": "Reads the list of Delivery Access Tokens in a Space, page by page.", "responseStatus": 200, "baseUrl": "https://cma.weegloo.com/v1", "pathParameterSchema": { "spaceId": { "type": "string", "description": "The sys.id of the Space", "required": true } }, "queryParameterSchema": { "limit": { "type": "integer", "description": "Number of items to return per page (1-100)", "default": 15 }, "skip": { "type": "integer", "description": "Number of items to skip", "default": 0 }, "next": { "type": "string", "description": "Next page cursor (the value obtained from links.next in the previous response)" }, "prev": { "type": "string", "description": "Previous page cursor (the value obtained from links.prev in the previous response)" }, "order": { "type": "string", "description": "Sort criteria. Comma-separated for multi-level sorting (e.g. sys.createdAt,sys.id)" }, "select": { "type": "string", "description": "Fields to include (sys.id,sys.createdAt) or exclude (-sys.id). Do not mix include and exclude." }, "include": { "type": "integer", "description": "Related-resource inclusion level. 0=default, 1=related resources, 2=nested relations, 3=full", "default": 0 } }, "additionalQueryParams": true, "requestHeaderSchema": { "Authorization": { "type": "string", "description": "Bearer token (CMA authentication)" } }, "responseExample": { "sys": { "type": "TotalPageResponse" }, "limit": 15, "totalCount": 1, "items": [ { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGndFQrblq", "type": "DeliveryAccessToken", "space": { "sys": { "id": "tcq4V2Xb", "type": "Refer", "targetType": "Space" } }, "user": { "sys": { "id": "3trmXRLdJIqc9GPBbyFYQQw6hf9kGj", "type": "Refer", "targetType": "User" } }, "createdBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "createdAt": "2026-06-18T09:25:32.624Z", "updatedBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "updatedAt": "2026-06-18T09:25:32.624Z", "accessToken": "DVRATbQ8mX2vK9pLs7Rf1Zt0Nc4Wd6Hg5Ua2Ee9Ck3PoYx8Bj6Hg5Ua2Ee9Ck3Po…", "scopes": ["DELIVERY_ACCESS_TOKEN"] }, "allowedReferrers": ["https://shop.example.com"], "description": "Read-only delivery token for the clothing store public site", "name": "Public website delivery" } ], "links": { "self": "/v1/spaces/tcq4V2Xb/delivery-access-tokens" } } } ``` ```api-endpoint { "title": "Create Delivery Access Token", "method": "POST", "path": "/spaces/{spaceId}/delivery-access-tokens", "description": "Issues a new Delivery Access Token in a Space. In role, put the sys.id of a least-privilege SpaceRole that defines the token's read scope. Do not bind the Administrator role. You can bind only a role you hold (Space administrators excepted), and trying to bind a role you do not have is rejected. In allowedReferrers, put the origins allowed to call this token. Sending the example values below as they are creates a token tied to the example.com domain, so replace them with the origin of the site that will actually deliver your content. Send an empty array to apply no restriction. The sys.accessToken in the response is the secret value used to call the CDA.", "responseStatus": 201, "baseUrl": "https://cma.weegloo.com/v1", "pathParameterSchema": { "spaceId": { "type": "string", "description": "The sys.id of the Space", "required": true } }, "requestHeaderSchema": { "Authorization": { "type": "string", "description": "Bearer token (CMA authentication)" } }, "requestBodySchema": { "type": "object", "required": ["name", "role"], "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64, "description": "Token name" }, "description": { "type": "string", "maxLength": 128, "description": "Description (optional)" }, "allowedReferrers": { "type": "array", "minItems": 0, "maxItems": 50, "items": { "type": "string" }, "description": "The list of origins allowed to call this token (e.g. https://shop.example.com, https://*.shop.example.com). Put the origin of the site that will deliver your content. An empty array applies no restriction." }, "role": { "type": "object", "description": "The Refer of the SpaceRole to bind. Put the sys.id of a least-privilege role in sys.id (Administrator forbidden)", "required": ["sys"], "properties": { "sys": { "type": "object", "required": ["id", "type", "targetType"], "properties": { "id": { "type": "string", "description": "The sys.id of the SpaceRole" }, "type": { "type": "string", "enum": ["Refer"] }, "targetType": { "type": "string", "enum": ["SpaceRole"] } } } } } }, "example": { "name": "Public website delivery", "description": "Read-only delivery token for the clothing store public site", "allowedReferrers": ["https://shop.example.com"], "role": { "sys": { "id": "3trmXRM3RqbgSnifyg7PLzmhWFANg9", "type": "Refer", "targetType": "SpaceRole" } } } }, "responseExample": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGndFQrblq", "type": "DeliveryAccessToken", "space": { "sys": { "id": "tcq4V2Xb", "type": "Refer", "targetType": "Space" } }, "user": { "sys": { "id": "3trmXRLdJIqc9GPBbyFYQQw6hf9kGj", "type": "Refer", "targetType": "User" } }, "createdBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "createdAt": "2026-06-18T09:25:32.624Z", "updatedBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "updatedAt": "2026-06-18T09:25:32.624Z", "accessToken": "DVRATbQ8mX2vK9pLs7Rf1Zt0Nc4Wd6Hg5Ua2Ee9Ck3PoYx8Bj6Hg5Ua2Ee9Ck3Po…", "scopes": ["DELIVERY_ACCESS_TOKEN"] }, "allowedReferrers": ["https://shop.example.com"], "description": "Read-only delivery token for the clothing store public site", "name": "Public website delivery" } } ``` ```api-endpoint { "title": "Read a single Delivery Access Token", "method": "GET", "path": "/spaces/{spaceId}/delivery-access-tokens/{deliveryAccessTokenId}", "description": "Reads one Delivery Access Token by sys.id. The sys.accessToken in the response returns the secret token value from issue time as-is.", "responseStatus": 200, "baseUrl": "https://cma.weegloo.com/v1", "pathParameterSchema": { "spaceId": { "type": "string", "description": "The sys.id of the Space", "required": true }, "deliveryAccessTokenId": { "type": "string", "description": "The sys.id of the Delivery Access Token", "required": true } }, "queryParameterSchema": { "include": { "type": "integer", "description": "Related-resource inclusion level. 0=default, 1=related resources, 2=nested relations, 3=full", "default": 0 } }, "requestHeaderSchema": { "Authorization": { "type": "string", "description": "Bearer token (CMA authentication)" } }, "responseExample": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGndFQrblq", "type": "DeliveryAccessToken", "space": { "sys": { "id": "tcq4V2Xb", "type": "Refer", "targetType": "Space" } }, "user": { "sys": { "id": "3trmXRLdJIqc9GPBbyFYQQw6hf9kGj", "type": "Refer", "targetType": "User" } }, "createdBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "createdAt": "2026-06-18T09:25:32.624Z", "updatedBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "updatedAt": "2026-06-18T09:25:32.624Z", "accessToken": "DVRATbQ8mX2vK9pLs7Rf1Zt0Nc4Wd6Hg5Ua2Ee9Ck3PoYx8Bj6Hg5Ua2Ee9Ck3Po…", "scopes": ["DELIVERY_ACCESS_TOKEN"] }, "allowedReferrers": ["https://shop.example.com"], "description": "Read-only delivery token for the clothing store public site", "name": "Public website delivery" } } ``` ```api-endpoint { "title": "Update Delivery Access Token", "method": "PUT", "path": "/spaces/{spaceId}/delivery-access-tokens/{deliveryAccessTokenId}", "description": "Updates the description and allowedReferrers of a Delivery Access Token. The name and role (the bound role) cannot be changed after issuance, so the body does not carry them. Leaving allowedReferrers out empties the list and lifts the restriction. Send the current value even when you are not changing the list. The example below is the origin entered at issue time plus all of its subdomains. PUT on this resource does not require the X-Weegloo-Version header.", "responseStatus": 200, "baseUrl": "https://cma.weegloo.com/v1", "pathParameterSchema": { "spaceId": { "type": "string", "description": "The sys.id of the Space", "required": true }, "deliveryAccessTokenId": { "type": "string", "description": "The sys.id of the Delivery Access Token", "required": true } }, "requestHeaderSchema": { "Authorization": { "type": "string", "description": "Bearer token (CMA authentication)" } }, "requestBodySchema": { "type": "object", "properties": { "description": { "type": "string", "maxLength": 128, "description": "Token description" }, "allowedReferrers": { "type": "array", "minItems": 0, "maxItems": 50, "items": { "type": "string" }, "description": "The list of origins allowed to call this token. An empty array applies no restriction. Leaving this property out also empties the list, so send the current value even when you are not changing it." } }, "example": { "description": "Public site delivery token v2", "allowedReferrers": ["https://shop.example.com", "https://*.shop.example.com"] } }, "responseExample": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGndFQrblq", "type": "DeliveryAccessToken", "space": { "sys": { "id": "tcq4V2Xb", "type": "Refer", "targetType": "Space" } }, "user": { "sys": { "id": "3trmXRLdJIqc9GPBbyFYQQw6hf9kGj", "type": "Refer", "targetType": "User" } }, "createdBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "createdAt": "2026-06-18T09:25:32.624Z", "updatedBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "updatedAt": "2026-06-18T09:31:42.018Z", "accessToken": "DVRATbQ8mX2vK9pLs7Rf1Zt0Nc4Wd6Hg5Ua2Ee9Ck3PoYx8Bj6Hg5Ua2Ee9Ck3Po…", "scopes": ["DELIVERY_ACCESS_TOKEN"] }, "allowedReferrers": ["https://shop.example.com", "https://*.shop.example.com"], "description": "Public site delivery token v2", "name": "Public website delivery" } } ``` ```api-endpoint { "title": "Partially update Delivery Access Token (JSON Patch)", "method": "PATCH", "path": "/spaces/{spaceId}/delivery-access-tokens/{deliveryAccessTokenId}", "description": "Updates only part of a Delivery Access Token (description, allowedReferrers) using RFC 6902 JSON Patch. You swap allowedReferrers by putting the whole list at the /allowedReferrers path, and every item goes through the origin notation check. The request Content-Type header must be application/json-patch+json. PATCH on this resource does not require the X-Weegloo-Version header.", "responseStatus": 200, "baseUrl": "https://cma.weegloo.com/v1", "pathParameterSchema": { "spaceId": { "type": "string", "description": "The sys.id of the Space", "required": true }, "deliveryAccessTokenId": { "type": "string", "description": "The sys.id of the Delivery Access Token", "required": true } }, "requestHeaderSchema": { "Authorization": { "type": "string", "description": "Bearer token (CMA authentication)" }, "Content-Type": { "type": "string", "description": "application/json-patch+json (RFC 6902 JSON Patch)" } }, "requestBodySchema": { "type": "array", "description": "An array of RFC 6902 JSON Patch operations (op / path / value / from). path is an RFC 6901 JSON Pointer.", "items": { "type": "object", "required": ["op", "path"], "properties": { "op": { "type": "string", "enum": ["add", "remove", "replace", "move", "copy", "test"], "description": "Operation kind" }, "path": { "type": "string", "description": "Target location (JSON Pointer). Example: /description, /allowedReferrers" }, "value": { "description": "The value used by add/replace/test" }, "from": { "type": "string", "description": "The source location for move/copy" } } }, "example": [ { "op": "replace", "path": "/description", "value": "Public site delivery token v2" }, { "op": "replace", "path": "/allowedReferrers", "value": ["https://shop.example.com", "https://*.shop.example.com"] } ] }, "responseExample": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGndFQrblq", "type": "DeliveryAccessToken", "space": { "sys": { "id": "tcq4V2Xb", "type": "Refer", "targetType": "Space" } }, "user": { "sys": { "id": "3trmXRLdJIqc9GPBbyFYQQw6hf9kGj", "type": "Refer", "targetType": "User" } }, "createdBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "createdAt": "2026-06-18T09:25:32.624Z", "updatedBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } }, "updatedAt": "2026-06-18T09:31:42.018Z", "accessToken": "DVRATbQ8mX2vK9pLs7Rf1Zt0Nc4Wd6Hg5Ua2Ee9Ck3PoYx8Bj6Hg5Ua2Ee9Ck3Po…", "scopes": ["DELIVERY_ACCESS_TOKEN"] }, "allowedReferrers": ["https://shop.example.com", "https://*.shop.example.com"], "description": "Public site delivery token v2", "name": "Public website delivery" } } ``` ```api-endpoint { "title": "Delete Delivery Access Token", "method": "DELETE", "path": "/spaces/{spaceId}/delivery-access-tokens/{deliveryAccessTokenId}", "description": "Deletes a Delivery Access Token. On success it responds with 204 No Content and no response body. Once deleted, CDA calls made with this token are no longer authenticated.", "responseStatus": 204, "baseUrl": "https://cma.weegloo.com/v1", "pathParameterSchema": { "spaceId": { "type": "string", "description": "The sys.id of the Space", "required": true }, "deliveryAccessTokenId": { "type": "string", "description": "The sys.id of the Delivery Access Token", "required": true } }, "requestHeaderSchema": { "Authorization": { "type": "string", "description": "Bearer token (CMA authentication)" } } } ``` ## Related documents {#related-documents} - [SpaceRole](/api/reference/cma/space-role.md): Defines the role (read scope) to bind to this token. - [CDA overview](/api/reference/cda.md): The delivery API that reads published content with this token. - [Space Access Token](/api/reference/cma/space-access-token.md): A token that can also write within one *Space* (it has the same origin restriction). - [Personal Access Token](/api/reference/cma/personal-access-token.md): A Weegloo User token for servers and CI.