service-accounts

Revoke one of this identity's credentials

Revokes the named credential at the identity provider and marks its record here revoked — a soft delete: the record stays, audited deleted, and the identity and any other credential survive. The kind is then free to be minted again.

The provider first, deliberately: a refusal leaves the credential live and the caller told why. A credential the provider no longer has (expired and purged, or revoked out of band) is already in the end state, so the record is retired rather than stuck. Distinct from DELETE /service-accounts/{principal_id}, which revokes the whole identity.

A secret backs redirect_uris. While the identity has redirect URIs, revoking its secret is 409: the code exchange authenticates with it. Clear redirect_uris first (PATCH).

Manageable by the identity's owner or an account admin (organization#clients_manage). A platform identity and an artifact's identity are unreachable by anyone and answer 404. Runs as the calling operator — the caller's bearer is forwarded.

delete/registry/v1/service-accounts/{principal_id}/credentials/{kind}

Request

  • Base URL: https://api.atlan.com (the document declares no server; this is the origin it was published from)
  • URL: https://api.atlan.com/registry/v1/service-accounts/{principal_id}/credentials/{kind}
  • Auth: HTTP bearer

Path parameters

principal_idstring required

The durable principal id

kindstring required

The credential kind: secret or api_key.

Response

The identity, with its remaining credentials.

client_idstring required

Stable identifier of the related client resource.

created_atstring required

Value of the created_at field.

created_bystring nullable

Value of the created_by field.

display_namestring nullable

Human-readable name.

idstring required

Stable identifier of this resource.

principal_typestring required

Always service_account: this surface lists and serves no other identity.

redirect_urisstring[] required

The client's OAuth redirect URIs; empty for a machine-only client. Non-empty means the client may run the authorization-code flow (authorization_code and refresh_token beside client_credentials). Changed with PATCH.

revoked_atstring nullable

Value of the revoked_at field.

scopesstring[] required

The client's scopes: the ceiling over what its seats allow. A subset of contextplane:read, contextplane:write, contextplane:manage and oauth-clients:manage. Changed with PATCH. A client with redirect_uris additionally holds openid and profile at the identity provider; they are derived, not stored here.

statusstring required

Current lifecycle state.

updated_atstring nullable

RFC 3339, when the identity was last renamed or its redirect URIs or scopes changed. Absent if none of that has happened.

Changes

No recorded changes to this operation across all 1 revision of this API.