---
title: "Revoke an Accounts-owned native registration"
method: POST
path: "/v1/internal/native-enrollments/revoke"
---

# Revoke an Accounts-owned native registration

`POST /v1/internal/native-enrollments/revoke`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/internal/native-enrollments/revoke`
- Auth: HTTP bearer

Default off. Accounts authorizes the current owner/admin of the exact existing Commerce workspace and signs a command. Core checks current Accounts JWKS and the SYNCED human workspace projection; no org, membership, merchant ADMIN key or Marketplace purchase is created. A command lease lasts at most 30 seconds, with at most 5 seconds future clock skew. JSON only; no query, Origin or Cookie. command_id has immutable semantic content; retries may refresh only issued_at and authorization_expires_at. No route executes a commerce or payment transaction. Requires current workspace owner/admin and the exact existing enrollment, connection and revision. No Microsoft login or provider access is needed. Removes READ permission, disconnects the sealed connection and advances revision. Exact retries do not increment again.

## Request body

- AccountsNativeEnrollmentRevokeEnvelope
  - `payload` AccountsNativeEnrollmentRevokeCommand, required
    - `version` 'accounts-native-enrollment-v1', required
    - `account_org_id` string, required
    - `account_workspace_id` string, required
    - `product` 'commerce', required
    - `workspace_environment` 'sandbox' | 'production', required
    - `command_id` string, uuid, required
    - `enrollment_id` string, uuid, required
    - `purpose` 'native_connection_enrollment', required
    - `account_user_id` string, required
    - `role` 'owner' | 'admin', required
    - `issued_at` string, date-time, required
    - `authorization_expires_at` string, date-time, required
    - `action` 'revoke', required
    - `existing_connection` AccountsNativeEnrollmentConnection, required
      - `connection_id` string, uuid, required
      - `expected_revision` integer, required
  - `evidence` AccountsNativeEnrollmentEvidence, required
    - `algorithm` 'Ed25519', required
    - `key_id` string, required
    - `payload_sha256` string, required
    - `signature` string, required

## Response `200`

Bounded enrollment metadata; execution_available remains false

- AccountsNativeEnrollmentRevoked
  - `version` 'accounts-native-enrollment-v1', required
  - `account_org_id` string, required
  - `account_workspace_id` string, required
  - `product` 'commerce', required
  - `workspace_environment` 'sandbox' | 'production', required
  - `command_id` string, uuid, required
  - `enrollment_id` string, uuid, required
  - `connection_id` string, uuid, required
  - `connection_revision` integer, required
  - `platform` 'D365_BC', required
  - `tenant_id` string, uuid, required
  - `environment_name` string, required
  - `company_id` string, uuid, required
  - `execution_available` false, required
  - `status` 'revoked', required
  - `read_granted` false, required
  - `provider_read_observed_at` unknown, required
  - `guard_enabled` unknown, required
  - `guard_configured` unknown, required

## Other responses

- `400`: Invalid bounded command or transport
- `401`: Dedicated Accounts service bearer required
- `403`: Current Accounts, identity or managed assignment authority denied
- `404`: Exact enrollment is not in the authorized workspace
- `409`: Command conflict, concurrent attempt or changed connection revision
- `413`: Command exceeds 8192 bytes
- `429`: Durable address or workspace request limit reached
- `503`: Enrollment disabled or required dependency unavailable

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)