---
title: "Revoke a signing key"
method: POST
path: "/v1/kms/issuers/{issuerId}/keys/{keyId}/revoke"
tags: ["kms"]
---

# Revoke a signing key

`POST /v1/kms/issuers/{issuerId}/keys/{keyId}/revoke`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v1/kms/issuers/{issuerId}/keys/{keyId}/revoke`
- Auth: HTTP bearer

Immediately revoke a signing key that is already scheduled for revocation.

## Path parameters

- `issuerId` string, required: The ID of the issuer.
- `keyId` string, required: The ID of the signing key to revoke immediately. The key must already be scheduled for revocation.

## Query parameters

- `teamId` string
- `slug` string

## Response `200`

- object
  - `algorithm` 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'RS256' | 'RS384' | 'RS512', required
  - `claimsSchema` object
  - `createdAt` string, required
  - `id` string, required
  - `managedBy` string
  - `name` string, required
  - `origin` 'external' | 'vercel', required
  - `ownerId` string, required
  - `policies` union[], required
    - union
      - object
        - `createdAt` string, required
        - `environments` string[], required: Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim.
        - `kind` 'project-grant', required
        - `projectId` string, required
        - `teamId` string, required
        - `tokenClaims` object
        - `updatedAt` string, required
      - object
        - `clientId` string, required
        - `createdAt` string, required
        - `kind` 'connex-grant', required
        - `tokenClaims` object
        - `updatedAt` string, required
  - `signingKeys` object[], required
    - `activateAt` string
    - `activatedAt` string: When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
    - `algorithm` string, required
    - `certificatePem` string: The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
    - `createdAt` string, required
    - `importKeyId` string: The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys.
    - `issuerId` string, required
    - `keyId` string, required: The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
    - `publicKey` object
      - `alg` string
      - `key_ops` string[]
      - `kid` string
      - `kty` string
      - `use` string
      - `x5c` string[]: The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.
      - `x5t#S256` string: The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9).
    - `publicKeyFingerprint` string, required
    - `publicKeyPem` string: The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it.
    - `revokeAt` string
    - `status` 'active' | 'pending' | 'revoking', required
    - `updatedAt` string, required
  - `updatedAt` string, required

## Other responses

- `400`: One of the provided values in the request query is invalid.
- `401`: The request is not authorized.
- `403`: You do not have permission to access this resource.
- `404`
- `409`
- `410`

## Changes

- **2026-09-24** `dd6a90982ed0`: 1 info
  - the response property `signingKeys/items/publicKeyFingerprint` became required for the status `200`
- **2026-09-16** `d1cd8167595b`: 1 info
  - removed the `EdDSA` enum value from the `algorithm` response property for the response status `200`
- **2026-08-19** `6b6e0450635c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vercel/apis/api/changes/v1/kms/issuers/:issuerId/keys/:keyId/revoke/post.md)

---

[API](https://skmtc.dev/vercel/apis/api.md) - [All operations](https://skmtc.dev/vercel/apis/api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/api/revisions/4a06e85c2848?raw)