# Revoke a Server Credential

For good, and at once: its next token is refused, the credential never changes again, and your endpoints that ask for it are told.

## Overview

- `reason`: 1 to 500 characters, kept with the credential (`revokeReason`), with who revoked it (`revokedBy`) and when (`revokedAt`); `updatedAt` and `updatedBy` keep the last change before it.
- Its tokens answer `401` `SERVER_CREDENTIAL_REVOKED` from the next request, also a token signed before. The credential stays listed with `status` `revoked`; its key can never be registered again.
- Revoking only protects: any of the roles that manage credentials revokes any credential of its tenant, whatever the credential's role. An expired credential can be revoked too.
- `404` `SERVER_CREDENTIAL_NOT_FOUND` for a credential that is not this tenant's; `409` `SERVER_CREDENTIAL_REVOKED` when it already is.
- It takes effect at once, whoever revokes. In the same step, the event `server_credential.revoked` — `data` the credential as this route answers it — is queued for every active webhook endpoint of your tenant that names it, in production and in sandbox, with one event id. An endpoint that names no type, and the webhook of an environment, never receive it: name it on an endpoint ([Webhooks & Events](https://docs.aureahub.com/docs/guide-events.md)).

## Endpoint

### `POST /v1/admin/tenants/{id}/server-credentials/{credentialId}/revoke`

Authentication: bearer token required.

Revokes a server credential for good.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | Tenant UUID |
| `credentialId` | string | yes | The credential's id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `reason` | string | yes | 1–500 characters |

**Responses**

`200` Revoked

```json
{
  "id": "2f6d8a4e-1c3b-4e5f-9a7d-0b2c4e6f8a1c",
  "tenantId": "6f1e2d3c-4b5a-4968-8776-a5b4c3d2e1f0",
  "name": "Payments server",
  "role": "signer",
  "status": "revoked",
  "publicKey": {
    "kty": "EC",
    "crv": "P-256",
    "x": "kTxt6XgA4C3r8RE3iDiksXglx-XqsKZBKcJXz8xb9Bg",
    "y": "2UOzdwbCN0bU_vBmtae1dx458v3t1PXqowMQIp9qahU"
  },
  "thumbprint": "eh1D5t_soPjcyGjYMXEeNtyTxia1As4QO91SxspJPfM",
  "allowedIps": ["203.0.113.0/24"],
  "expiresAt": "2027-10-06T00:00:00.000Z",
  "createdAt": "2026-10-06T08:40:12.307Z",
  "createdBy": "5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d",
  "updatedAt": "2026-10-06T08:40:12.307Z",
  "updatedBy": "5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d",
  "lastUsedAt": "2026-10-20T07:41:09.006Z",
  "revokedAt": "2026-10-20T07:55:31.210Z",
  "revokedBy": "5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d",
  "revokeReason": "Rotated to the new payments server key",
  "roleNarrows": true
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/admin/tenants/$TENANT_ID/server-credentials/$CREDENTIAL_ID/revoke \
  -H "Authorization: Bearer $TENANT_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Rotated to the new payments server key" }'
```

---

Web version: https://docs.aureahub.com/#server-credential-revoke