---
title: "Revoke an override with an audit reason (owner/admin)"
method: POST
path: "/api/v1/risk/overrides/{id}/revoke"
tags: ["Risk"]
---

# Revoke an override with an audit reason (owner/admin)

`POST /api/v1/risk/overrides/{id}/revoke`

## Request

- Base URL: `https://api.korala.ai`
- URL: `https://api.korala.ai/api/v1/risk/overrides/{id}/revoke`
- Auth: one of:
  - API key in header `X-API-Key`
  - `bearer` (a scheme the document does not define)

## Path parameters

- `id` string, required

## Headers

- `Idempotency-Key` string
- `X-Risk-Mode` string
- `X-Korala-Mode` 'live' | 'test'
- `idempotency-key` string, required

## Request body

- RiskReasonDto
  - `reason` string, required

## Response `201`

- RiskRecordDto
  - `id` string, uuid, required
  - `resource` 'sources' | 'contexts' | 'subjects' | 'policies' | 'evidence' | 'assessments' | 'overrides' | 'actions' | 'events' | 'investigations' | 'investigation-reviews', required
  - `data` union, required: Typed persisted resource. Use the resource discriminator to select its data schema.
    - RiskContextDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `kind` string, required
      - `externalId` string, required
      - `createdBy` string, required
      - `policyRevision` number, required: Revision of the context policy configuration.
    - RiskSourceDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `scopes` RiskSourceScopesDto, required
        - `subject` boolean, required: Permit general subject evidence.
        - `contextKinds` string[], required: Context kinds this source may submit evidence for. General subject permission is configured separately.
      - `key` string, required
      - `facts` RiskSourceFactDto[], required
        - `key` string, required
        - `type` 'string' | 'number' | 'boolean' | 'list', required
        - `itemType` 'string' | 'number' | 'boolean'
      - `apiKeyIds` string[], required
      - `enabled` boolean, required
      - `revision` number, required
      - `createdBy` string, required
      - `updatedBy` string, required
      - `updatedAt` string, date-time, required
    - RiskInvestigationDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `subjectId` string, uuid, required
      - `requestedBy` string, required
      - `externalProcessingConfirmedAt` string, date-time, nullable, required
      - `status` 'pending' | 'processing' | 'completed' | 'failed', required
      - `provider` string, required
      - `questionVersion` string, required
      - `snapshot` RiskInvestigationSnapshotDto, required
        - `capturedAt` string, date-time, required
        - `evidenceRevision` number, required
        - `assessmentRevision` number, required
        - `eventId` string, nullable, required
        - `eventCount` number, required
        - `truncated` boolean, required
        - `evidence` RiskInvestigationEvidenceDto[], required
          - `id` string, uuid, required
          - `fact` string, required
          - `source` string, required
          - `status` 'available' | 'unavailable' | 'revoked', required
          - `value` union, required
            - string
            - number
            - boolean
            - union[]
              - …
          - `expiresAt` string, date-time, nullable, required
        - `assessments` RiskInvestigationAssessmentDto[], required
          - `id` string, required
          - `policyKey` string, required
          - `policyVersionId` string, required
          - `band` string, nullable, required
          - `decision` string, required
          - `validUntil` string, date-time, nullable, required
          - `missing` RiskMissingFactDto[], required
            - `fact` string, required
            - `reason` string, required
        - `actions` RiskInvestigationActionDto[], required
          - `id` string, uuid, required
          - `key` string, required
          - `status` 'requested' | 'acknowledged' | 'completed' | 'failed' | 'cancelled', required
          - `revision` number, required
      - `findings` RiskInvestigationFindingDto[], required
        - `id` string, required
        - `kind` 'rule' | 'comparison_candidate' | 'mock_judgment' | 'ai_judgment', required
        - `title` string, required
        - `detail` string, required
        - `outcome` 'attention' | 'uncertain', required
        - `sources` RiskInvestigationSourceDto[], required
          - `resource` 'evidence' | 'assessments' | 'actions' | 'events', required
          - `id` string, uuid, required
        - `suggestedQuestion` string, required
      - `completedAt` string, date-time, nullable, required
      - `failure` string, nullable, required
    - RiskInvestigationReviewDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `subjectId` string, uuid, required
      - `investigationId` string, uuid, required
      - `findingId` string, required
      - `disposition` 'accepted' | 'dismissed', required
      - `reason` string, required
      - `actor` string, required
    - RiskSubjectDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `kind` string, required
      - `externalId` string, required
      - `evidenceRevision` number, required
      - `assessmentRevision` number, required
    - RiskPolicyDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `key` string, required
      - `version` number, required
      - `definition` object, required
        - `schemaVersion` string: Policy format version. Omission denotes legacy version 1; unrelated to the published policy revision.
        - `inputs` object[], required
          - `key` string, required
          - `scope` 'subject' | 'current_context'
          - `derivedReuse` object
            - `profileId` string, uuid, required
            - `output` string, required
          - `verification` object
            - `stepType` string
            - `stepIndex` integer, required
            - `field` string, required
            - `transform` 'identity' | 'age_years'
            - `workflowDefinitionId` string, uuid, required
            - `workflowUpdatedAt` string, date-time, required
          - `label` string
          - `kind` 'text' | 'number' | 'boolean' | 'list' | 'country' | 'choice' | 'money' | 'date' | 'datetime'
          - `allowedValues` string[]
          - `currency` string
          - `decimalPlaces` integer
          - `unit` string
          - `itemType` 'string' | 'number' | 'boolean'
          - `type` 'string' | 'number' | 'boolean' | 'list', required
          - `evidenceKind` 'observed' | 'model_signal'
          - `requirement` 'required' | 'supporting'
          - `acceptedSources` string[], required
          - `maxAgeSeconds` integer, required
        - `applicability` object[]
          - `id` string, required
          - `all` object[], required
            - `fact` string, required
            - `operator` 'eq' | 'in' | 'contains' | 'gte' | 'gt' | 'lte' | 'lt' | 'eq_fact' | 'neq_fact', required
            - `value` union, required
              - …
        - `eligibility` object[]
          - `id` string, required
          - `reason` string, required
          - `all` object[], required
            - `fact` string, required
            - `operator` 'eq' | 'in' | 'contains' | 'gte' | 'gt' | 'lte' | 'lt' | 'eq_fact' | 'neq_fact', required
            - `value` union, required
              - …
        - `factors` object[], required
          - `id` string, required
          - `label` string, required
          - `match` 'first' | 'highest', required
          - `weight` number, required
          - `defaultPoints` number
          - `cases` object[], required
            - `when` object, required
              - …
            - `points` number, required
        - `aggregation` 'sum' | 'max', required
        - `floor` number, required
        - `ceiling` number, required
        - `bands` object[], required
          - `id` string, required
          - `min` number, required
          - `effect` object, required
            - `decision` 'none' | 'review' | 'restrict' | 'reject', required
            - `actions` string[], required
        - `rules` object[], required
          - `id` string, required
          - `reason` string, required
          - `all` object[], required
            - `fact` string, required
            - `operator` 'eq' | 'in' | 'contains' | 'gte' | 'gt' | 'lte' | 'lt' | 'eq_fact' | 'neq_fact', required
            - `value` union, required
              - …
          - `forceBand` string
          - `effect` object, required
            - `decision` 'none' | 'review' | 'restrict' | 'reject', required
            - `actions` string[], required
        - `missingEvidence` 'awaiting_evidence' | 'review', required
        - `reviewAfterSeconds` integer
      - `status` 'draft' | 'published', required
      - `createdBy` string, required
      - `publishedBy` string, nullable, required
      - `publishedAt` string, date-time, nullable, required
    - RiskEvidenceDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `provenance` RiskReceiptProvenanceDto, required
        - `sourceRegistrationId` string, uuid, required
        - `sourceRevision` number, required
        - `assertedBy` string, required
        - `adapter` 'registered-external-v1', required
        - `evidenceClass` 'assertion', required
      - `subjectId` string, uuid, required
      - `fact` string, required
      - `source` string, required
      - `status` 'available' | 'unavailable' | 'revoked', required
      - `value` union, required
        - string
        - number
        - boolean
        - union[]
          - union
            - string
            - number
            - boolean
      - `observedAt` string, date-time, required
      - `expiresAt` string, date-time, nullable, required
      - `providerRef` string, nullable, required
      - `modelProvenance` RiskModelProvenanceDto, required
        - `provider` string, required
        - `model` string, required
        - `criteriaVersion` string, required
        - `inputDigest` string, required: SHA-256 of the exact model input snapshot
        - `runId` string, required
      - `revision` number, required
      - `supersedesId` string, uuid, nullable, required
    - RiskAssessmentDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `subjectId` string, uuid, required
      - `policyVersionId` string, uuid, required
      - `policyKey` string, required
      - `policySnapshot` object, required
        - `schemaVersion` string: Policy format version. Omission denotes legacy version 1; unrelated to the published policy revision.
        - `inputs` object[], required
          - `key` string, required
          - `scope` 'subject' | 'current_context'
          - `derivedReuse` object
            - `profileId` string, uuid, required
            - `output` string, required
          - `verification` object
            - `stepType` string
            - `stepIndex` integer, required
            - `field` string, required
            - `transform` 'identity' | 'age_years'
            - `workflowDefinitionId` string, uuid, required
            - `workflowUpdatedAt` string, date-time, required
          - `label` string
          - `kind` 'text' | 'number' | 'boolean' | 'list' | 'country' | 'choice' | 'money' | 'date' | 'datetime'
          - `allowedValues` string[]
          - `currency` string
          - `decimalPlaces` integer
          - `unit` string
          - `itemType` 'string' | 'number' | 'boolean'
          - `type` 'string' | 'number' | 'boolean' | 'list', required
          - `evidenceKind` 'observed' | 'model_signal'
          - `requirement` 'required' | 'supporting'
          - `acceptedSources` string[], required
          - `maxAgeSeconds` integer, required
        - `applicability` object[]
          - `id` string, required
          - `all` object[], required
            - `fact` string, required
            - `operator` 'eq' | 'in' | 'contains' | 'gte' | 'gt' | 'lte' | 'lt' | 'eq_fact' | 'neq_fact', required
            - `value` union, required
              - …
        - `eligibility` object[]
          - `id` string, required
          - `reason` string, required
          - `all` object[], required
            - `fact` string, required
            - `operator` 'eq' | 'in' | 'contains' | 'gte' | 'gt' | 'lte' | 'lt' | 'eq_fact' | 'neq_fact', required
            - `value` union, required
              - …
        - `factors` object[], required
          - `id` string, required
          - `label` string, required
          - `match` 'first' | 'highest', required
          - `weight` number, required
          - `defaultPoints` number
          - `cases` object[], required
            - `when` object, required
              - …
            - `points` number, required
        - `aggregation` 'sum' | 'max', required
        - `floor` number, required
        - `ceiling` number, required
        - `bands` object[], required
          - `id` string, required
          - `min` number, required
          - `effect` object, required
            - `decision` 'none' | 'review' | 'restrict' | 'reject', required
            - `actions` string[], required
        - `rules` object[], required
          - `id` string, required
          - `reason` string, required
          - `all` object[], required
            - `fact` string, required
            - `operator` 'eq' | 'in' | 'contains' | 'gte' | 'gt' | 'lte' | 'lt' | 'eq_fact' | 'neq_fact', required
            - `value` union, required
              - …
          - `forceBand` string
          - `effect` object, required
            - `decision` 'none' | 'review' | 'restrict' | 'reject', required
            - `actions` string[], required
        - `missingEvidence` 'awaiting_evidence' | 'review', required
        - `reviewAfterSeconds` integer
      - `previousId` string, uuid, nullable, required
      - `evidenceRevision` number, required
      - `sequence` number, required
      - `trigger` string, required
      - `result` RiskEvaluationDto, required
        - `eligibility` RiskEligibilityResultDto
          - `evaluatorVersion` 'risk-eligibility-v1', required
          - `status` 'eligible' | 'ineligible' | 'unknown', required
          - `criteria` RiskRuleResultDto[], required
            - `id` string, required
            - `matched` boolean, nullable, required
            - `reason` string, required
          - `missing` RiskMissingFactDto[], required
            - `fact` string, required
            - `reason` string, required
          - `validUntil` string, date-time, nullable, required
        - `evaluatorVersion` 'risk-v1', required
        - `status` 'complete' | 'incomplete', required
        - `score` number, nullable, required
        - `band` string, nullable, required
        - `decision` 'none' | 'review' | 'restrict' | 'reject' | 'awaiting_evidence', required
        - `missing` RiskMissingFactDto[], required
          - `fact` string, required
          - `reason` string, required
        - `inputs` RiskEvaluationInputDto[], required
          - `provenance` RiskReceiptProvenanceDto
            - `sourceRegistrationId` string, uuid, required
            - `sourceRevision` number, required
            - `assertedBy` string, required
            - `adapter` 'registered-external-v1', required
            - `evidenceClass` 'assertion', required
          - `providerRef` string, nullable
          - `modelProvenance` RiskModelProvenanceDto
            - `provider` string, required
            - `model` string, required
            - `criteriaVersion` string, required
            - `inputDigest` string, required: SHA-256 of the exact model input snapshot
            - `runId` string, required
          - `id` string, uuid, required
          - `fact` string, required
          - `value` union, required
            - string
            - number
            - boolean
            - union[]
              - …
          - `source` string, required
          - `status` 'available' | 'unavailable' | 'revoked', required
          - `observedAt` string, date-time, required
          - `receivedAt` string, date-time, required
          - `expiresAt` string, date-time, nullable, required
        - `coverage` RiskInputCoverageDto[]
          - `fact` string, required
          - `requirement` 'required' | 'supporting', required
          - `status` 'available' | 'unavailable', required
          - `reason` string, nullable, required
        - `factors` RiskFactorResultDto[], required
          - `id` string, required
          - `points` number, required
          - `weight` number, required
          - `contribution` number, required
          - `matchedCases` number[], required
        - `rules` RiskRuleResultDto[], required
          - `id` string, required
          - `matched` boolean, nullable, required
          - `reason` string, required
        - `actions` string[], required
        - `validUntil` string, date-time, nullable, required
      - `validUntil` string, date-time, nullable, required
    - RiskOverrideDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `subjectId` string, uuid, required
      - `assessmentId` string, uuid, required
      - `sequence` number, required
      - `decision` 'none' | 'review' | 'restrict' | 'reject', required
      - `reason` string, required
      - `actor` string, required
      - `expiresAt` string, date-time, required
      - `revokedAt` string, date-time, nullable, required
    - RiskActionDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `subjectId` string, uuid, required
      - `assessmentId` string, uuid, required
      - `key` string, required
      - `status` 'requested' | 'acknowledged' | 'completed' | 'failed' | 'cancelled', required
      - `revision` number, required
      - `updatedAt` string, date-time, required
    - RiskEventDataDto
      - `id` string, uuid, required
      - `organizationId` string, uuid, required
      - `sandbox` boolean, required
      - `createdAt` string, date-time, required
      - `subjectId` string, uuid, nullable, required
      - `resourceId` string, uuid, required
      - `type` string, required
      - `actor` string, required
      - `detail` object, required

## Other responses

- `400`: Malformed UUID in path parameter (`id`).

---

[API](https://skmtc.dev/korala/apis/korala-public-api.md) · [All operations](https://skmtc.dev/korala/apis/korala-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/korala/apis/korala-public-api/revisions/5c4d7810c507?raw)