VocalDocscontracts 1.65.0

Revoke the active platform credential of a Provider

DELETE /v1/platform/credentials/{provider}

PropertyValue
Operationrevoke_platform_credential
GroupPlatform
Scopeplatform:write
Route classcontrol
IdempotencyNo Idempotency-Key
AuditAudited platform.credential.revoke (mutation)
Released in1.10.0
Phase 0 hostServed (the hosted api pins 1.65.0)

Revokes the active version If-Match names and answers it with status revoked; with * it revokes every active member of the Provider's key pool (1.28.0; before it, the one active version) and answers the newest of them. not_found when the Provider has no active credential. Running Sessions keep the secret they were issued; once no enabled member is left, the worker uses its environment key for the Provider's next Sessions.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the platform:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X DELETE "$VOCAL_API/v1/platform/credentials/mock" \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H 'If-Match: "1"'

Parameters

NameInTypeRequiredDescription
providerpathProviderIdyesA Provider: a vendor or in-process model behind a stage. The provider catalog says which stages each serves and whether it is available. From 1.38.0 openai is deprecated (workspace ADR 0085): its descriptors read deprecated, a deprecated Provider still resolves, and the id is kept until a major release; deepseek is new. From 1.53.0 amazon_titan serves embeddings, reserved until its adapter is built.
if-matchheaderstringyesThe revision the change was made against, quoted as the ETag returns it, or * to overwrite.

Responses

StatusContent typeShapeError codes
200application/jsonPlatformCredential
400application/jsonErrorEnvelopeinvalid_request
401application/jsonErrorEnvelopeunauthenticated
403application/jsonErrorEnvelopeforbidden
404application/jsonErrorEnvelopenot_found
412application/jsonErrorEnveloperevision_mismatch
428application/jsonErrorEnvelopeprecondition_required
429application/jsonErrorEnveloperate_limited
500application/jsonErrorEnvelopeinternal_error

Fields of the 200 answer

The shape is PlatformCredential.

FieldTypeRequiredDescription
accountVendorAccountUsagenoThe last reading the api took of the vendor account behind the member (1.40.0): its status, the units used and allowed and the plan's tier. Absent when the api has taken none, when the vendor has no account request, or from an api older than 1.40.0. A member whose key authenticates can still read exhausted.
active_sessionsintegernoThe Sessions whose unreleased reservations name the member as the first entry of a stage, across Organizations, when the api answered (1.28.0); a count only. The api from 1.28.0 always sends it.
created_atTimestampyes
created_byActorRefyes
enabledbooleannoWhether admission may choose the member (1.28.0); a disabled member keeps its secret, serves no new Session and leaves running Sessions on it. The api from 1.28.0 always sends it, and a reader treats its absence as true.
hintstringyesThe last four characters of the secret, to tell keys apart; never more.
idPlatformCredentialIdnoThe member's id (1.28.0), the key id the Session configuration and the trace name. The api from 1.28.0 always sends it.
labelstring or nullyesAn operator note, or null.
max_concurrent_sessionsMaxConcurrentSessions or nullnoThe member's cap on concurrent Sessions (1.28.0), or null for no cap. The api from 1.28.0 always sends it, and a reader treats its absence as null.
object"platform_credential"yes
providerProviderIdyes
revisionintegernoCounts the member's changes from 1 (1.28.0); PATCH takes it in If-Match. The api from 1.28.0 always sends it.
revoked_atTimestamp or nullyesNull while the version is active.
statusPlatformCredentialStatusyes
versionintegeryesCounts the Provider's credential entries from 1.