Two methods can be used to delete tokens in bulk:

Send a Batch Delete request for a list of tokens. The steps to configure batch input file and send the Batch Delete request can be found under KAM Batch Operations in the KA Administration Guide.

Schedule a Delete Encryption Requests job in DACTool to delete tokens by age.

1. Login to the appliance as strongauth.
2. Open strongkeylite-configuration.properties using a text editor.

   shell> vi /usr/local/strongauth/strongkeylite/etc/strongkeylite-configuration.properties

3. Add the following properties at the end of the file:

   strongkeylite.cfg.property.encryptionrequestremovaljob.cutoff=<The amount of time that must lapse between an encryption request and the request (with its encrypted sensitive data) being deleted permanently from the database. While there is no upper limit to the cutoff period, the lower limit is 1.>
   strongkeylite.cfg.property.encryptionrequestremovaljob.cutoff.units=<Valid options: days, hours, minutes, and seconds>
   strongkeylite.cfg.property.encryptionrequestremovaljob.log=true
   strongkeylite.cfg.property.encryptionrequestremovaljob.run=tru

4. Save and exit the file.
5. Restart Payara (GlassFish) application server, and Set KC-PINs.
6. Login to DACTool using the domainadmin.JCEKS file.
7. Navigate to Jobs → Scheduled Jobs.
8. Select Delete Encryption Requests → Schedule.
   
9. Provide the number of minutes (from now) after which you would like the first job to start and select the frequency of the job.
10. Save and Exit DACTool.