VocalDocscontracts 1.65.0

Revoke the Organization's credential for a Provider

DELETE /v1/provider-credentials/{provider}

PropertyValue
Operationrevoke_provider_credential
GroupProviders and credentials
Scopecredentials:write
Route classcontrol
IdempotencyNo Idempotency-Key
AuditAudited provider_credential.revoke (mutation)
Released in1.28.0
Phase 0 hostServed (the hosted api pins 1.65.0)

Revokes the active version If-Match names (or any, with *) and answers it with status revoked; not_found when the Organization has no active credential for the Provider (1.28.0). The Organization's next Calls run the Provider on the platform's keys. From 1.34.0 the description states what a revocation does to the Calls in progress (workspace ADR 0082, decision 5), where 1.28.0 said that they keep the version they were issued: a revocation ends the Calls that use the key. The sweeper of the api, at its next sweep (every 5 seconds by default, a target), asks the end of each Call in progress whose recorded credential is the revoked version, as POST /v1/calls/{call_id}/end does, with the reason code credential_revoked on the Call event call.end_requested and the Audit event call.end; the worker ends the Session canceled at its next signal (every 15 seconds by default), about 20 seconds in all (a target), and a Call no worker runs yet ends canceled at once. The Audit event provider_credential.revoke is written in the revocation's own transaction and does not wait for the sweep, and a Call claimed between the revocation and the next sweep starts on the withdrawn key and is ended by that sweep. A rotation by PUT replaces the key and does not withdraw it, so a Call in progress stays on the version it was issued. Session only: the api refuses the route to every API key, whatever its scopes, and accepts a Member ID token with credentials:write.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the credentials:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X DELETE "$VOCAL_API/v1/provider-credentials/mock" \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H 'If-Match: "1"'

Parameters

NameInTypeRequiredDescription
providerpathProviderIdyesA Provider: a vendor or in-process model behind a stage. The provider catalog says which stages each serves and whether it is available. From 1.38.0 openai is deprecated (workspace ADR 0085): its descriptors read deprecated, a deprecated Provider still resolves, and the id is kept until a major release; deepseek is new. From 1.53.0 amazon_titan serves embeddings, reserved until its adapter is built.
if-matchheaderstringyesThe revision the change was made against, quoted as the ETag returns it, or * to overwrite.

Responses

StatusContent typeShapeError codes
200application/jsonProviderCredential
400application/jsonErrorEnvelopeinvalid_request
401application/jsonErrorEnvelopeunauthenticated
403application/jsonErrorEnvelopeforbidden, org_suspended
404application/jsonErrorEnvelopenot_found
412application/jsonErrorEnveloperevision_mismatch
428application/jsonErrorEnvelopeprecondition_required
429application/jsonErrorEnveloperate_limited
500application/jsonErrorEnvelopeinternal_error

Fields of the 200 answer

The shape is ProviderCredential.

FieldTypeRequiredDescription
accountVendorAccountUsagenoThe last reading the api took of the vendor account behind the key (1.40.0): its status, the units used and allowed and the plan's tier. Absent when the api has taken none, when the vendor has no account request, or from an api older than 1.40.0. A key that passed can still read exhausted.
created_atTimestampyes
created_byActorRefyes
hintstringyesThe last four characters of the secret, to tell keys apart; never more.
idProviderCredentialIdyesThe credential id, the key id the Session configuration and the trace name for a stage on this key.
labelstring or nullyesA note of the Member who entered the key, or null.
object"provider_credential"yes
providerProviderIdyes
revoked_atTimestamp or nullyesNull while the version is active.
statusProviderCredentialStatusyes
verificationProviderCredentialVerificationyes
verified_atTimestamp or nullyesWhen the vendor answered the check; null when the check is not_offered.
versionintegeryesCounts the Organization's entries for the Provider from 1.