---
title: "Revoke a Core key for an Accounts-authorized workspace"
method: POST
path: "/v1/internal/workspace-credentials/revoke"
---

# Revoke a Core key for an Accounts-authorized workspace

`POST /v1/internal/workspace-credentials/revoke`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/internal/workspace-credentials/revoke`
- Auth: HTTP bearer

Disabled until the dedicated Accounts service credential is configured. Accounts authorizes current owner/admin membership and Commerce access, then signs a command bound to its exact organization, workspace, user, environment and protocol purpose. Core requires a synchronized existing workspace projection, verifies the signature through the configured Accounts JWKS and checks authorization expiry after lock waits. Commands expire within 60 seconds; issued_at may be at most 5 seconds ahead. command_id is globally immutable across actors, workspaces and actions; only authorization timestamps may change on retry. JSON only, no query parameters, cookies or Origin header. This creates no native platform connection and grants no ERP execution authority. Revokes only the exact key in the signed workspace credential namespace. Repeating the same authorized command is idempotent. Revocation does not modify a native provider connection.

## Request body

- AccountsWorkspaceCredentialRevokeEnvelope
  - `payload` AccountsWorkspaceCredentialRevokeCommand, required
    - `version` 'accounts-workspace-credential-v1', required
    - `command_id` string, uuid, required
    - `purpose` 'protocol', required
    - `account_org_id` string, required
    - `account_workspace_id` string, required
    - `account_user_id` string, required
    - `product` 'commerce', required
    - `environment` 'sandbox' | 'production', required
    - `role` 'owner' | 'admin', required
    - `issued_at` string, date-time, required
    - `authorization_expires_at` string, date-time, required
    - `action` 'revoke', required
    - `key_id` string, uuid, required
  - `evidence` AccountsWorkspaceCredentialEvidence, required
    - `algorithm` 'Ed25519', required
    - `key_id` string, required
    - `payload_sha256` string, required
    - `signature` string, required

## Response `200`

Revoked credential metadata

- AccountsWorkspaceCredentialRevoked (unresolved $ref)

## Other responses

- `400`: Invalid or conflicting bounded command fields
- `401`: Dedicated Accounts service authentication required
- `403`: Command authority or exact workspace projection denied
- `404`: Credential is not in the authorized workspace namespace
- `409`: Command identity or credential binding conflicts
- `413`: Command exceeds the 8192-byte body limit
- `429`: Durable per-address or workspace request limit reached
- `503`: Credential adapter or required dependency unavailable

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)