Revoking is immediate and permanent. Any service still using the token starts failing right away — so the confirm is honest about what breaks, especially when the token is in active use.
This extra step exists because the token is live. It prevents an accidental revoke.
Contract. DELETE /api/organizations/{orgId}/tokens/{tokenId} → 204
(idempotent). Revocation is server-side and immediate; the row disappears from the list on success.
Interaction rules. (d1) an ordinary token gets a single confirm. (d2) a token that shows
recent activity ("in active use") escalates to type-to-confirm — Revoke stays
disabled (data-requires-name-match) until the typed name matches, because revoking
a live credential is a foot-gun that deserves friction. "Active use" is derived from the same
last-used signal frame (a) commissions; until that field exists, treat every token as ordinary
(d1) rather than guessing.