Org

Revoke a source-access wrapper

Revokes one of the caller's own wrappers (step-up required for a control-plane session — wrapper revocation is recovery-posture-affecting; a SIWX wallet is inherently fresh). The last-wrapper rule is CUSTODY-SCHEME-AWARE (consult round 1): a wrapped_random_v1 key can never reach zero active wrappers while active — its last revoke requires deactivate_key: true, which revokes the KEY atomically with the wrapper; a wrapped_legacy_scalar_v1 (migrated) key allows confirm_last_wrapper: true, because its original enrollment passkey can still derive the scalar (wrapper revocation is not cryptographic revocation — rotate the key to detach that credential). Deny → 403 never 404: a foreign wrapper id and a nonexistent one are indistinguishable.

delete/agent/v1/source-access/wrappers/{wrapper_id}

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/agent/v1/source-access/wrappers/{wrapper_id}
  • Auth: one of:
    • API key in header SIGN-IN-WITH-X
    • HTTP bearer

Path parameters

wrapper_idstring uuid required

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

confirm_last_wrapperboolean

wrapped_legacy_scalar_v1 only: revoke the last ACTIVE wrapper anyway (the ORIGINAL enrollment passkey can still derive the key — wrapper revocation is not cryptographic revocation; rotate the key to detach that credential).

deactivate_keyboolean

wrapped_random_v1 only: a random key can NEVER reach zero wrappers while active — revoking its last wrapper requires revoking the KEY atomically with it (envelopes to it stop being openable).

Response

Wrapper revoked

wrapper_idstring uuid
kindstring
revokedboolean
remaining_active_wrappersinteger
key_statestring

revoked when deactivate_key revoked the key atomically with its last wrapper.

Changes

No recorded changes to this operation across all 1 revision of this API.