---
title: "Revoke the caller's active agent credential, if any."
method: DELETE
path: "/v1/agent/credential"
tags: ["agent"]
---

# Revoke the caller's active agent credential, if any.

`DELETE /v1/agent/credential`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/v1/agent/credential`
- Auth: one of:
  - API key in cookie `dvt_session`
  - HTTP bearer

Idempotent — no active credential is treated as already-deleted (204 either way).

## Response `204`

Revoked (idempotent).

## Other responses

- `401`: Missing, invalid, or expired session.
- `403`: `https://docs.dvt.dev/errors/not-in-edition` — snowflake mode under `DVT_AGENT_IDENTITY=caller` only (DVT-3961, ADR-0082 Option A): `editionCapabilities.agentCredentialsCrud` is false there, so per-user agent-PAT registration is unavailable — the ingress caller token IS the credential, so there is nothing to register. Manage agent access via Snowflake roles/grants instead.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)