---
title: "Preview the vaults taking members' keys away would leave without a key"
method: POST
path: "/users/dvak-revocation/preview"
tags: ["users"]
---

# Preview the vaults taking members' keys away would leave without a key

`POST /users/dvak-revocation/preview`

## Request

- Base URL: `https://api.sparkvault.com/v1`
- URL: `https://api.sparkvault.com/v1/users/dvak-revocation/preview`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/sparkvault/apis/sparkvault-api/docs/users/dvak-revocation/preview/post.ts> (a function with typed inputs; its response is checked against the schema)

Removing a member, taking their license away or moving them to View Only revokes every Delegated Vault Access Key (DVAK) they hold (org admins only). This names the vaults that change would leave with no live DVAK, read as it would find the keys now, so the admin can be warned before confirming. Read-only: nothing is revoked. An id the organization holds no member for holds no key of its vaults and adds nothing.

## Request body

- object
  - `user_ids` string[], required: The members the change names.

## Response `200`

The vaults the change would leave without a key.

- object
  - `data` VaultsLeftWithoutKey, required
    - `vaults_left_without_key` object[], required: The vaults that would hold no live Delegated Vault Access Key once every key of the named members is revoked: no other member, integration or platform feature would hold one. Unless someone kept a vault's master key, nobody could open it again. In name order.
      - `vault_id` string, required: The vault's id (`vlt_…`).
      - `name` string, required: The vault's name.
  - `meta` ResponseMeta: Envelope metadata present on every successful response.
    - `api_version` string
    - `request_id` string
    - `response_ms` integer
    - `timestamp` integer: Unix seconds.
    - `pools` object: Storage and bandwidth capacity snapshot for the account.
    - `billing` object
      - `past_due` boolean
    - `quota` object: This minute of the account request budget. Present on authenticated success responses that passed the throttle; absent otherwise.
      - `limit` integer
      - `used` integer
      - `remaining` integer
      - `resets_at` integer: Unix seconds.

## Other responses

- `400`: VALIDATION_ERROR — `user_ids` is missing, empty, holds a blank or non-string id, or names more than 10,000 members.
- `401`: AUTHENTICATION_ERROR — missing or invalid credentials.
- `403`: FORBIDDEN — the caller is not an org admin, or the credential is not an interactive session.
- `429`: RATE_LIMIT_EXCEEDED — the account exceeded 5000 requests this minute. `Retry-After` carries the seconds to wait, and `details` carries limit/resets_at, plus `used` whenever the request was counted. A request refused because the limiter itself was unavailable reports no `used`.

## Changes

- **2026-10-28** `a9a10e328ba5`: 16 info
  - the response property `error/details` became required for the status `400`
  - the response property `error/details` became required for the status `401`
  - the response property `error/details` became required for the status `403`
  - the response property `error/details` became required for the status `429`
  - …12 more
- **2026-10-28** `56d7c265a77a`: 4 breaking
  - the response property `error/details` became nullable for the status `400`
  - the response property `error/details` became nullable for the status `401`
  - the response property `error/details` became nullable for the status `403`
  - the response property `error/details` became nullable for the status `429`
- **2026-10-26** `aa14909854a3`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/sparkvault/apis/sparkvault-api/changes/users/dvak-revocation/preview/post.md)

---

[API](https://skmtc.dev/sparkvault/apis/sparkvault-api.md) - [All operations](https://skmtc.dev/sparkvault/apis/sparkvault-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sparkvault/apis/sparkvault-api/revisions/97cfadccd0c0?raw)