---
title: "Revoke a secret"
method: POST
path: "/api/v1/account/credentials/secrets/{secretId}/revoke"
tags: ["Credentials"]
---

# Revoke a secret

`POST /api/v1/account/credentials/secrets/{secretId}/revoke`

## Request

- Base URL: `https://api.sahha.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sahha.ai/api/v1/account/credentials/secrets/{secretId}/revoke`
- Auth: API key in header `Authorization`

Stops the secret authenticating. A client secret stops minting account tokens immediately; an app secret stops registering profiles within five minutes. Tokens already issued are unaffected. The reason is required and recorded. Any member of the account can restore the secret within 24 hours.

## Path parameters

- `secretId` string, uuid, required

## Query parameters

- `environment` string

## Request body

- RevokeCredentialSecretRequest
  - `accountId` string, uuid: The account the credential belongs to.
  - `environment` string: sandbox or production. It must be the environment the request is sent to.
  - `credentialType` string: application or client.
  - `reason` string: Why the secret is being revoked. Recorded against it.

## Response `200`

Every secret of the credential after the revoke.

- CredentialSecretsResponse
  - `secrets` CredentialSecretDto[]: Every secret of the credential after the change.
    - `id` string, uuid: The secret's id, used to revoke or restore it.
    - `credentialType` string: application or client.
    - `isLegacy` boolean: True for a secret issued before rotation launched. Its value stays readable on the credential while it can authenticate.
    - `status` string: active, expired or revoked.
    - `hint` string, nullable: The secret's prefix and last four characters, such as sahha_app_prod_...Ab3x, enough to tell secrets apart and to confirm a revoke. A legacy secret's hint is its last four characters alone.
    - `createdAt` string, date-time
    - `expiresAt` string, date-time, nullable: When the secret stops authenticating. Null while it has no expiry.
    - `revokedAt` string, date-time, nullable
    - `restoredAt` string, date-time, nullable
    - `lastUsedAt` string, date-time, nullable: The last time the secret authenticated, to within five minutes.

## Other responses

- `400`: The request isn't valid, has no reason, or its environment isn't the one it was sent to.
- `401`: Not signed in.
- `403`: Not a member of the account.
- `404`: The account has no such credential in the environment, or the credential has no secret with this id.
- `409`: The secret is already expired or revoked.
- `429`: Too many credential changes by this user.

---

[API](https://skmtc.dev/sahha/apis/sahha-platform-v1.md) - [All operations](https://skmtc.dev/sahha/apis/sahha-platform-v1/llms.txt) - [OpenAPI document](https://skmtc.dev/sahha/apis/sahha-platform-v1/revisions/c7f918b46707?raw)