---
title: "Platform-security revoke an identity link"
method: DELETE
path: "/identity-links/v1/admin/{identity_link_id}"
tags: ["Identity Links"]
---

# Platform-security revoke an identity link

`DELETE /identity-links/v1/admin/{identity_link_id}`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/identity-links/v1/admin/{identity_link_id}`
- Auth: API key in header `x-admin-key`

High-severity, audited platform-admin revocation only. It cannot create, move, or reactivate a link.

## Path parameters

- `identity_link_id` string, required

## Request body

- object
  - `reason_code` 'credential_compromise' | 'security_response', required

## Response `200`

Revoked public proof

- IdentityLinkProof
  - `identity_link_id` string, required
  - `proof_protocol` 'run402.identity-link.nostr.v1' | 'run402.identity-link.nostr.human.v1', required
  - `status` 'active' | 'revoked', required
  - `effective_status` 'active' | 'revoked' | 'principal_inactive', required
  - `verified_at` string, date-time, required
  - `revoked_at` string, date-time, nullable, required
  - `public_subject` string, required
  - `display_subject` string, required
  - `proved_principal` IdentityLinkPrincipalAttribution, required
    - `principal_id` string, required
    - `principal_type` string, required
  - `effective_principal` IdentityLinkPrincipalAttribution, required
    - `principal_id` string, required
    - `principal_type` string, required
  - `public_payload` string, nullable, required
  - `wallet_signature` string, nullable, required
  - `nostr_event` NostrIdentityProofEvent, required
    - `id` string, required
    - `pubkey` string, required
    - `created_at` integer, required: Exact signed NIP-01 event time in Unix seconds. This protocol envelope field is the only identity-link exception to the ISO-8601 HTTP timestamp contract; converting it would invalidate the event id and signature.
    - `kind` 1 | 24243, required
    - `tags` array[], required
      - string[]: Protocol-discriminated public proof tags: optional NIP-OA for agent kind-1 proofs, or exact Run402 challenge-binding tags for human kind-24243 proofs.
    - `content` string, required: Exact RFC 8785 serialization of {public_payload,wallet_signature}.
    - `sig` string, required
  - `verification_statement` HumanIdentityLinkVerificationStatement, required
    - `schema_version` 1, required
    - `acceptance_context` 'standalone_human_link' | 'buzz_human_adoption', required
    - `adopting_principal` 'run402_verified', required
    - `target_session` 'run402_verified' | 'legacy_run402_verified', required
    - `fresh_passkey` 'run402_verified', required
    - `verified_at` string, date-time, required

## Other responses

- `400`: Invalid reason code
- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.
- `403`: The credential verified but is not a platform admin (ADMIN_REQUIRED)
- `404`: Identity link not found

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)