The REST API is an agent authentication API, for sending Passcodes to Authentication Manager, or authentication request to the SecurID Access Cloud servicve.
Disabling a token is an Administrative task in Authentication Manager, so you need to use the Admin API. The quickest easiest way would be to use the Authentication Manager Bulk Administration utility, AMBA, which is part of AM 8.4
https://community.rsa.com/docs/DOC-97710
There's an SDK for the Admin API. There are also options like AM Prime. You might start looking at the AM 8.x extras
https://community.rsa.com/docs/DOC-100084
