Revoke one of a site's keys

POST

/v1/projects/{projectId}/sites/{siteId}/keys/{kid}/revoke

curl --request POST \
  --url https://example.com/v1/projects/example/sites/example/keys/example/revoke \
  --header 'Authorization: Bearer <token>'

• Same-origin — path relative to the deployment root.

Statements signed with it are refused from now on, and the site’s live sessions end. Tenant admins only.

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

ProjectId — opaque branded string.

siteId

required

string

The site id (a UUID).

kid

required

string

The key’s id.

Header Parameters

Idempotency-Key

string

>= 1 characters

Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per docs/API-ROUTE-CONVENTIONS.md §3.1). A retry sent while the first request still runs is answered 409 idempotency-key-in-flight with Retry-After, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets 409 idempotency-key-replay-withheld, with the first request’s status and when it succeeded (from 0.1.5).

Responses

200

The site, without the key.

Media typeapplication/json

A site that signs its own people in to one project: it vouches for whoever is signed in there, so they ask the project’s agents and decide its approvals as themselves. Each person it signs in is a person of the tenant, shown as “, via ”.

object

siteId

required

string format: uuid

projectId

required

string format: uuid

displayName

required

Set by a tenant admin, never by the site: shown after every name the site signs in.

string

origin

required

The site’s origin (https://acme-store.example).

string

approvalsUrl

required

Where an approval opens on the site; {approvalId} is replaced. A site’s people get it in their reviewer email.

string

allowedRoles

required

Array<string>

roleMap

required

Role → grant. A person with several allowed roles gets the most any of them gives.

object

key

additional properties

What a person with one of the site’s roles gets in the site’s project. Reading the project comes with every role; nothing above it ever does.

object

ask

required

Whether they may start turns with the project’s agents.

boolean

reviewer

The reviewer role they decide approvals with, at most the site’s reviewerCeiling; absent: they decide none.

string

Allowed values: standard senior

reviewerCeiling

required

string

Allowed values: standard senior

vouching

required

Whether the site’s statements are accepted.

boolean

peopleCap

required

At most this many live people from the site.

integer

>= 1

newPeoplePerDay

required

At most this many new people from the site per day.

integer

>= 1

keys

required

Array<object>

One of the site’s live public keys. Kindgi never has a private half.

object

kid

required

string

thumbprint

required

The key’s RFC 7638 thumbprint, to compare with the one the site shows.

string

addedAt

required

string format: date-time

audience

What the site’s statements carry as aud: this deployment’s public URL, given at enrollment.

string

createdAt

required

string format: date-time

createdBy

string

pausedAt

string format: date-time

unregisteredAt

string format: date-time

Example

{
  "roleMap": {
    "additionalProperty": {
      "reviewer": "standard"
    }
  },
  "reviewerCeiling": "standard"
}

400

Malformed request body.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

403

Not a tenant admin.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

404

No site with that id in this project, or no key with that id (site-not-found).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

409

Idempotency-Key was reused with a different body, or resource-state conflict.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

500

Server error (unmapped domain code or framework crash).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also

• GET /v1/projects/{projectId}: Fetch a project by id
• PATCH /v1/projects/{projectId}: Partially update a project
• DELETE /v1/projects/{projectId}: Delete a project (idempotent)
• GET /v1/projects/{projectId}/judging-rules: List a project's judging rules
• Error code site-not-found
• Every error code