---
title: "Revoke a credential"
method: POST
path: "/credentials/revoke"
tags: ["Credentials"]
---

# Revoke a credential

`POST /credentials/revoke`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/credentials/revoke`
- Auth: HTTP bearer

Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.

Person only: a dashboard session. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.

## Headers

- `Idempotency-Key` string

## Request body

- CredentialsRevokeCredentialInput
  - `kind` 'org_key' | 'function_key' | 'connected_key' | 'oauth' | 'agent_delegate' | 'cli_user_access', required
  - `id` string, required
  - `reason` string
  - `choices` object[]
    - `kind` 'endpoint' | 'function_trigger' | 'pull_subscription' | 'recipient_route' | 'filter_rule' | 'scheduled_send' | 'repeating_send' | 'wake_schedule' | 'function', required
    - `id` string, required
    - `decision` 'keep' | 'stop', required

## Response `200`

Success

- object
  - `success` true, required
  - `data` CredentialsRevokeCredentialResult, required
    - `revoked` number, required
    - `kind` 'org_key' | 'function_key' | 'connected_key' | 'oauth' | 'agent_delegate' | 'cli_user_access', required
    - `id` string, required
    - `kept` object[]
      - `kind` string, required
      - `id` string, required

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `409`: The request conflicts with the current state of the resource
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)