---
title: "Retire a previous owner's vault writers after a project transfer (owner + step-up)"
method: POST
path: "/vaults/v1/{vault_id}/writers/retire-previous-owner"
tags: ["vault"]
---

# Retire a previous owner's vault writers after a project transfer (owner + step-up)

`POST /vaults/v1/{vault_id}/writers/retire-previous-owner`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/writers/retire-previous-owner`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Owner + step-up (`gitvault.rotate`). Gateway-blocks every active writer key whose principal holds no active developer-or-above membership on the vault's current organization, and records `reason: "org_transferred"` on the audit trail. Ordinary pushes then refuse `EPOCH_ROTATION_REQUIRED` until a `rotate_epoch` with reason `writer_key_revoked` removes exactly that set; `run402 repos access retire-previous-owner` calls this route and commits that rotation. A project transfer never does this on its own. Retiring protects only what is written after the rotation: anyone who held the vault's key before keeps what they could already read. Idempotent; reports `retired: []` when nothing is outside the organization.

## Path parameters

- `vault_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

The retired set

- object
  - `repo_id` string
  - `retired` object[]
    - `writer_key_id` string
    - `principal_id` string, uuid, nullable
  - `rotation_required` boolean
  - `note` string
  - `next_actions` object[]

## Other responses

- `403`: VAULT_ACCESS_DENIED / STEP_UP_REQUIRED / FORBIDDEN (a staff credential cannot retire writers)
- `409`: PROJECT_HAS_PENDING_TRANSFER

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)