---
title: "Revoke a source-access wrapper"
method: DELETE
path: "/agent/v1/source-access/wrappers/{wrapper_id}"
tags: ["Org"]
---

# Revoke a source-access wrapper

`DELETE /agent/v1/source-access/wrappers/{wrapper_id}`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/source-access/wrappers/{wrapper_id}`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Revokes one of the caller's own wrappers (step-up required for a control-plane session — wrapper revocation is recovery-posture-affecting; a SIWX wallet is inherently fresh). The last-wrapper rule is CUSTODY-SCHEME-AWARE (consult round 1): a `wrapped_random_v1` key can never reach zero active wrappers while active — its last revoke requires `deactivate_key: true`, which revokes the KEY atomically with the wrapper; a `wrapped_legacy_scalar_v1` (migrated) key allows `confirm_last_wrapper: true`, because its original enrollment passkey can still derive the scalar (wrapper revocation is not cryptographic revocation — rotate the key to detach that credential). Deny → 403 never 404: a foreign wrapper id and a nonexistent one are indistinguishable.

## Path parameters

- `wrapper_id` string, uuid, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `confirm_last_wrapper` boolean: wrapped_legacy_scalar_v1 only: revoke the last ACTIVE wrapper anyway (the ORIGINAL enrollment passkey can still derive the key — wrapper revocation is not cryptographic revocation; rotate the key to detach that credential).
  - `deactivate_key` boolean: wrapped_random_v1 only: a random key can NEVER reach zero wrappers while active — revoking its last wrapper requires revoking the KEY atomically with it (envelopes to it stop being openable).

## Response `200`

Wrapper revoked

- object
  - `wrapper_id` string, uuid
  - `kind` string
  - `revoked` boolean
  - `remaining_active_wrappers` integer
  - `key_state` string: `revoked` when deactivate_key revoked the key atomically with its last wrapper.

## Other responses

- `403`: FORBIDDEN (not your wrapper, or it does not exist) | STEP_UP_REQUIRED
- `409`: LAST_WRAPPER — scheme-aware: a wrapped_random key needs deactivate_key: true (never confirm-through); a migrated key needs confirm_last_wrapper: true

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)