---
title: "Revoke a tax ID transfer"
method: POST
path: "/accounts/{account}/nif-transfers/{nif_transfer}/revoke"
tags: ["Account"]
---

# Revoke a tax ID transfer

`POST /accounts/{account}/nif-transfers/{nif_transfer}/revoke`

## Request

- Base URL: `https://api.factuarea.com/v1`
- URL: `https://api.factuarea.com/v1/accounts/{account}/nif-transfers/{nif_transfer}/revoke`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Revoke a tax ID transfer your account issued before anyone accepts it; its secret then no longer moves the tax ID.
- Returns 200 with `status: revoked`; optional `reason` (max 500 characters) goes to the audit trail.
- Irreversible but idempotent; requires `Idempotency-Key`.
- 422 `business_rule_violation` if already accepted; 404 `resource_not_found`. Requires the `nif_transfers:write` scope, which `*` does not cover: the API key must list it explicitly.

## Path parameters

- `account` string, uuid, required
- `nif_transfer` string, uuid, required

## Headers

- `Idempotency-Key` string, required
- `Factuarea-Version` string, date

## Request body

- RevokeNifTransferV1Request: Optional body of the tax ID transfer revocation. `reason` (string, up to 500 characters) is optional and is recorded in the audit trail; everything that decides the operation — which transfer, which account — comes from the path and the credential.
  - `reason` string, nullable: Optional reason for the revocation (up to 500 characters, recorded in the audit log).

## Response `200`

- object
  - `data` NifTransfer, required: A voucher that hands ONE NIF of an account over to another account. Issuing one is already giving away control of that NIF: whoever accepts the secret gets the NIF, and taking it back requires the OTHER party to act. The plaintext secret is NOT part of this representation and cannot be: only its irreversible fingerprint is stored, so no later read can return it.
    - `id` string, uuid, required: Opaque identifier of the tax ID transfer, a UUID v7.
    - `object` 'nif_transfer', required: Always `nif_transfer`.
    - `company_id` string, uuid, required: Opaque identifier (UUID v7) of the NIF this transfer gives away.
    - `expires_at` string, date-time, required: Expiry instant (ISO 8601).
    - `status` 'active' | 'expired' | 'revoked' | 'consumed', required: DERIVED state, read against the clock: the table has no status column. `revoked` means the issuing account withdrew it before anyone accepted it. A consumed or revoked transfer and one that never existed are deliberately indistinguishable on acceptance.
    - `recipient_account_id` string, uuid, nullable, required: Opaque identifier (UUID v7) of the ONLY account that can accept this transfer, or `null` when whoever holds the secret can accept it.
    - `issued_at` string, date-time, nullable, required: When the transfer was issued (ISO 8601), or `null` when the instant is not recorded.
    - `consumed_at` string, date-time, nullable, required: When the transfer was accepted (ISO 8601), or `null` while nobody accepted it. It does not say WHICH account accepted it.
    - `revoked_at` string, date-time, nullable, required: When the issuing account revoked the transfer (ISO 8601), or `null` if it was not revoked.

## Other responses

- `400`: `parameter_unknown` with `subcode` `retired_active_profile_header`: the retired `X-Active-Profile` header was sent; the company goes in the path. `parameter_invalid_format` on `Factuarea-Version`: the header is not a `YYYY-MM-DD` date. `unsupported_api_version`: the `Factuarea-Version` date is not a supported version.
- `401`: Missing or invalid API key.
- `403`: The request is authenticated but not allowed: the API key lacks the required scope (`insufficient_scope`), the plan does not include the public API or this feature (`addon_not_active`, `feature_not_available_in_plan`), or the module is not available with a test key (`module_not_available_in_sandbox`).
- `404`: The requested resource does not exist or belongs to another company. `account_not_found`: the account in the path does not exist or is not the account of the API key.
- `422`: Validation failed — e.g. the API key plan limit was reached, or an invoice language outside the allowed catalog (`es`, `en`, `ca`). The `error.param` field identifies which input is invalid, if any. `idempotency_key_reused`: the `Idempotency-Key` was already used with a different body; send a new key or the same body. `invalid_param_format` on `Idempotency-Key`: the key must be 1 to 255 printable ASCII characters. `idempotency_key_required`: this operation requires the `Idempotency-Key` header; the message names the rejected operation.
- `429`: Rate limit exceeded. Retry after the duration in `Retry-After`.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/factuarea/apis/factuarea-public-api.md) · [All operations](https://skmtc.dev/factuarea/apis/factuarea-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/factuarea/apis/factuarea-public-api/revisions/718e77934422?raw)