---
title: "Declare a recipient key revoked (owner + step-up)"
method: POST
path: "/vaults/v1/{vault_id}/recipients/{principal_id}/key-revocation"
tags: ["vault"]
---

# Declare a recipient key revoked (owner + step-up)

`POST /vaults/v1/{vault_id}/recipients/{principal_id}/key-revocation`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/recipients/{principal_id}/key-revocation`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Owner + step-up (`gitvault.rotate`, protocol rev 42 D199). Declares `reason:"recipient_key_revoked"` admissible on this vault's ORGANIZATION — advances the same org-level watermark a member removal advances (`internal.vault_recipient_state_counters`), so a subsequent urgent `rotate_epoch` admission is not refused `EPOCH_ROTATION_REQUIRED`.

## Path parameters

- `vault_id` string, required
- `principal_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

The org's recipient-state counters after the declaration

- object
  - `recipient_state_version` string
  - `recipient_revocation_version` string

## Other responses

- `403`: VAULT_ACCESS_DENIED

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)