---
title: "Revoke authorization"
method: DELETE
path: "/api/v1/authorizations/{id}"
tags: ["Authorizations"]
---

# Revoke authorization

`DELETE /api/v1/authorizations/{id}`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/authorizations/{id}`
- Auth: HTTP bearer

Revoke an active or pending authorization. Optionally provide a reason.

## Path parameters

- `id` string, required: MongoDB ObjectId

## Request body

- RevokeAuthorizationBody
  - `reason` string: Reason for revocation

## Response `200`

Authorization revoked

- Authorization: Authorization granting permission to send confirmations via a specific channel
  - `id` string, required: MongoDB ObjectId
  - `status` 'pending' | 'active' | 'expired' | 'revoked' | 'denied', required: Status of an authorization
  - `hitl_id` string: HITL configuration this authorization is linked to (confirmations scope; absent for identity_challenge scope)
  - `circle_id` string: Circle this authorization is linked to (identity_challenge scope; absent for confirmations scope)
  - `recipient` string, nullable: Channel-specific recipient identifier (chat_id for Telegram, phone or BSUID for WhatsApp)
  - `phone` string, nullable
  - `bsuid` string, nullable: WhatsApp Business-Scoped User ID
  - `channel` 'whatsapp' | 'telegram' | 'sms' | 'email', required: Channel authorized for sending confirmations
  - `scope` 'confirmations' | 'identity_challenge', required: Scope of the authorization. `identity_challenge` is the Proof of Me scope.
  - `business_name` string, required
  - `label` string, nullable: Owner-assigned human label for this approver (F22); null when unset. Surfaces lead with it, falling back to the masked recipient.
  - `recipient_display_name` string, nullable, required: The approver's own messenger name ("First Last @username"), captured when they approved over Telegram; null when none was captured. Chosen by the approver, not verified.
  - `enrolled` boolean, required: Whether the approver has enrolled an encryption key. A confirmation can be sealed to an approver only once this is true; consent alone (`status: active`) is not enough.
  - `verification_id` string: MongoDB ObjectId
  - `proof_token` string: Signed proof of the recipient's decision, minted when they approved or refused, for both scopes. Absent while no decision has been made.
  - `authorized_at` string, date-time
  - `denied_at` string, date-time: When the recipient refused — the mirror of `authorized_at` for a `denied` row (a challenger cancellation stamps it too). Absent unless the authorization was denied; before it existed such a row carried no decision time at all, only `updated_at`.
  - `expires_at` string, date-time, required
  - `revoked_at` string, date-time
  - `revocation_reason` string
  - `confirmations_sent` integer, required
  - `last_used_at` string, date-time
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Cannot revoke (already revoked or invalid status)
- `404`: Authorization not found

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/b15f506de696?raw)