Revoke Credential
POST/api/v1/issuer/credentials/:credentialId/revoke
Permanently revokes a credential you issued. The change is published to the Network Credential Registry and checked during Verification Gateway verification.
action | Result |
|---|---|
revoke | Permanent — the credential can never be used again. Allowed for claimed, accepted and suspended credentials, and for a pending offer whose registry entry was created at offer time (an offer with no registry entry returns 404) |
suspend | Not supported: returns 501. Credentials are registered on a revocation status list only, so a suspension would not be visible to verifiers |
The registry is authoritative. If the offer already shows revoked, expired or rejected, Credential Factory still sends the request to the registry, so it can succeed (204) when the entry is still active — for example after an earlier best-effort registry update failed. If the registry entry is already revoked (this includes offers that expired unclaimed, whose entries are retired as revoked), the call returns 409.
Request
Responses
- 204
- 400
- 401
- 403
- 404
- 409
- 500
- 501
- 503
Credential status updated. No response body.
Invalid request — credentialId is not in urn:uuid: form, or action is missing or invalid.
Authentication required — missing, invalid, or expired access token.
Token lacks the issuance.credential.revoke scope.
Credential not found, or never registered.
The credential is already revoked.
Internal server error.
action suspend is not supported.
Revocation unavailable — the Network Credential Registry integration is not enabled (contact iDen2), or the registry or offer storage could not complete the update, including a registry refusal while the offer is not yet final (retry with backoff).