account

Revoke a key

Deletes a key. It is a 401 key_invalid from the next call, over HTTP and MCP. Every box the key linked is unlinked with it, each with a fresh allowance (boxUnlink).

  • Cost: Free. Signed by the owner over method DELETE, path /account/v1/<address lowercased>/key/<id> and no body (the hash of no bytes). The ARCGATE-KEY header does not authorize it: a call with only a key is a 401 signature_required.
  • Inputs: address and id (path). No body.
  • Returns: revoked and the id. The account and its other keys are untouched, and so are the boxes its other keys and its owner linked.
  • Errors:
    • 404 account_not_found: the address has no account.
    • 404 key_not_found: the account has no key with that id. It was never made, was already revoked, or is another account's.
  • Next:
    • keyCreate: make another key.
delete/account/v1/{address}/key/{id}

Request

  • Base URL: https://api.arcgate.dev
  • URL: https://api.arcgate.dev/account/v1/{address}/key/{id}
  • Auth: none required

Path parameters

addressstring required

The account owner's address, any letter case. One account per address, and a signed request must be signed by it.

idstring required

A key's id, key_ and 22 base64url characters, as keyCreate and keyList answer it. It is not the secret.

Headers

AGENT-SIGNATUREstring required

The EIP-712 signature (0x hex) over the AgentRequest typed data (the AccountRequest typed data on /account/v1, which also begins with origin, the API's base URL with no trailing slash): the box's address (the owner's on /account/v1), this request's method and path with every parameter filled in (the address lowercased), the keccak256 of its canonical-JSON body (of no bytes when there is none), the nonce and the expiry. Domain {name: "arcgate", version: "1"}, no chainId; a wallet that can only sign with one (such as Circle's) may add the chainId of the chain this deployment serves (5042 on Arc mainnet), and no other. A missing header is a 401 signature_required.

AGENT-NONCEstring required

A fresh random 32-byte value (0x hex), the signed nonce. Each is accepted once per box (per owner on /account/v1): a repeat is a 401 nonce_reused.

AGENT-EXPIRYinteger required

The signed expiry, unix seconds: in the future, and no further ahead than 300 seconds from now. Otherwise 401 signature_expired.

Response

The key is revoked.

revokedtrue required

Always true: the key is gone.

idstring required

A key's id, key_ and 22 base64url characters, as keyCreate and keyList answer it. It is not the secret.

Changes

No recorded changes to this operation across all 1 revision of this API.