Revoke the Organization's credential for a Provider
DELETE /v1/provider-credentials/{provider}
| Property | Value |
|---|---|
| Operation | revoke_provider_credential |
| Group | Providers and credentials |
| Scope | credentials:write |
| Route class | control |
| Idempotency | No Idempotency-Key |
| Audit | Audited provider_credential.revoke (mutation) |
| Released in | 1.28.0 |
| Phase 0 host | Served (the hosted api pins 1.65.0) |
Revokes the active version If-Match names (or any, with *) and answers it with status revoked; not_found when the Organization has no active credential for the Provider (1.28.0). The Organization's next Calls run the Provider on the platform's keys. From 1.34.0 the description states what a revocation does to the Calls in progress (workspace ADR 0082, decision 5), where 1.28.0 said that they keep the version they were issued: a revocation ends the Calls that use the key. The sweeper of the api, at its next sweep (every 5 seconds by default, a target), asks the end of each Call in progress whose recorded credential is the revoked version, as POST /v1/calls/{call_id}/end does, with the reason code credential_revoked on the Call event call.end_requested and the Audit event call.end; the worker ends the Session canceled at its next signal (every 15 seconds by default), about 20 seconds in all (a target), and a Call no worker runs yet ends canceled at once. The Audit event provider_credential.revoke is written in the revocation's own transaction and does not wait for the sweep, and a Call claimed between the revocation and the next sweep starts on the withdrawn key and is ended by that sweep. A rotation by PUT replaces the key and does not withdraw it, so a Call in progress stays on the version it was issued. Session only: the api refuses the route to every API key, whatever its scopes, and accepts a Member ID token with credentials:write.
Request
Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the credentials:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.
curl -X DELETE "$VOCAL_API/v1/provider-credentials/mock" \
-H "Authorization: Bearer $VOCAL_API_KEY" \
-H 'If-Match: "1"'const response = await fetch(`${process.env.VOCAL_API}/v1/provider-credentials/mock`, {
method: 'DELETE',
headers: {
Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
'If-Match': '"1"',
},
});
console.log(response.status, await response.text());import os
import requests
response = requests.delete(
f"{os.environ['VOCAL_API']}/v1/provider-credentials/mock",
headers={
"Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
"If-Match": '"1"',
},
)
print(response.status_code, response.text)Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
provider | path | ProviderId | yes | A Provider: a vendor or in-process model behind a stage. The provider catalog says which stages each serves and whether it is available. From 1.38.0 openai is deprecated (workspace ADR 0085): its descriptors read deprecated, a deprecated Provider still resolves, and the id is kept until a major release; deepseek is new. From 1.53.0 amazon_titan serves embeddings, reserved until its adapter is built. |
if-match | header | string | yes | The revision the change was made against, quoted as the ETag returns it, or * to overwrite. |
Responses
| Status | Content type | Shape | Error codes |
|---|---|---|---|
200 | application/json | ProviderCredential | |
400 | application/json | ErrorEnvelope | invalid_request |
401 | application/json | ErrorEnvelope | unauthenticated |
403 | application/json | ErrorEnvelope | forbidden, org_suspended |
404 | application/json | ErrorEnvelope | not_found |
412 | application/json | ErrorEnvelope | revision_mismatch |
428 | application/json | ErrorEnvelope | precondition_required |
429 | application/json | ErrorEnvelope | rate_limited |
500 | application/json | ErrorEnvelope | internal_error |
Fields of the 200 answer
The shape is ProviderCredential.
| Field | Type | Required | Description |
|---|---|---|---|
account | VendorAccountUsage | no | The last reading the api took of the vendor account behind the key (1.40.0): its status, the units used and allowed and the plan's tier. Absent when the api has taken none, when the vendor has no account request, or from an api older than 1.40.0. A key that passed can still read exhausted. |
created_at | Timestamp | yes | |
created_by | ActorRef | yes | |
hint | string | yes | The last four characters of the secret, to tell keys apart; never more. |
id | ProviderCredentialId | yes | The credential id, the key id the Session configuration and the trace name for a stage on this key. |
label | string or null | yes | A note of the Member who entered the key, or null. |
object | "provider_credential" | yes | |
provider | ProviderId | yes | |
revoked_at | Timestamp or null | yes | Null while the version is active. |
status | ProviderCredentialStatus | yes | |
verification | ProviderCredentialVerification | yes | |
verified_at | Timestamp or null | yes | When the vendor answered the check; null when the check is not_offered. |
version | integer | yes | Counts the Organization's entries for the Provider from 1. |