`POST /api/keys/acl/revoke`

Remove a principal's ACL entry entirely.

Removes the WHOLE entry identified by (aclId, systemId, principalId), then verifies by the entry being absent from a fresh read.

WARNING: rights is not accepted on this route and sending it is a 400. There is no partial revocation of individual bits: the entry is identified by its compare key and removed entire. A mask here would look like a partial revocation and would silently do the other thing. To reduce a principal to fewer rights, use POST /api/keys/acl/update with the mask you want it to end up with.

Authentication

Send the session id as Authorization: Bearer <session id>, and an RFC 9449 DPoP proof in the DPoP header if your session is bound to a key. The two are required together, not as alternatives — see Authenticating and Proving you hold your key.

This surface sets no cookie

There is no session cookie on any response and none is read on any request. Do not set credentials: "include" on a browser fetch.

Request

Field	Type	Required	Description
`ttag`	`string`	yes	Canonical base64.
`systemId`	`integer`	yes
`principalId`	`integer` or `string`	yes
`maxUsage`	`integer`	no
`startTime`	`string`	no	base64 of exactly 8 bytes.
`endTime`	`string`	no	base64 of exactly 8 bytes.

Example

{
  "ttag": "...",
  "systemId": 0,
  "principalId": 0,
  "maxUsage": 0,
  "startTime": "...",
  "endTime": "..."
}

Responses

`200`

The entry is gone, verified by its ABSENCE from a fresh read.

Field	Type	Required	Description
`code`	`string`	no	Absent on success; `NOT_VERIFIED` when the read-back disagrees.
`operation`	`string`	no	Which key-server operation was sent.
`verified`	`boolean`	no
`requestedRights`	`integer` or `null`	no	Null on revoke, which takes no rights.
`requestedRightNames`	`array` or `null`	no
`entry`	`AclEntry` or `variant`	no	The matching entry from the fresh read, or null. Null is the SUCCESS case on revoke.
`acl`	`AclInfo`	no
`detail`	`string`	no

entry — AclEntry

Field	Type	Required	Description
`principalId`	`string`	no	Decimal string. Feeds straight back into the grant/update/revoke routes and into export.
`systemId`	`integer`	no
`aclEntryId`	`string`	no	base64 opaque handle
`aclId`	`string`	no	base64 opaque handle
`rights`	`integer`	no	The rights bitmask AS THE KEY SERVER HOLDS IT. The key server WIDENS what is asked for -- requesting WRITE reads back as WRITE\|READ -- so test this with a mask AND, never with equality.
`rightNames`	array of `string` (`OWNER`, `READ`, `WRITE`, `MANDATORY_GROUP`, `HOST_MATRIX`)	no
`maxUsage`	`integer`	no	-1 means no limit.
`userRight`	`integer`	no
`startTime`	`string`	no	base64 of the raw 8-byte stamp
`startTimeUnset`	`boolean`	no	True when the stamp is all zero -- the "no window" default, reported rather than converted into a date it does not mean.
`endTime`	`string`	no	base64 of the raw 8-byte stamp
`endTimeUnset`	`boolean`	no

AclInfo

Field	Type	Required	Description
`aclId`	`string`	no
`hiddenLink`	`object`	no	The hidden link as the key server reports it on the ACL object. Its shape is the key server's and is passed through unchanged; do not depend on it. Use the `ttag` you sent.
`expired`	`boolean`	no
`entryCount`	`integer`	no
`entries`	array of `AclEntry`	no	One ACL entry -- one principal's rights over one key.

Example

{
  "code": "...",
  "operation": "...",
  "verified": true,
  "requestedRights": 0,
  "requestedRightNames": [
    "..."
  ],
  "entry": {
    "principalId": "...",
    "systemId": 0,
    "aclEntryId": "...",
    "aclId": "...",
    "rights": 0,
    "rightNames": [
      "OWNER"
    ],
    "maxUsage": 0,
    "userRight": 0,
    "startTime": "...",
    "startTimeUnset": true,
    "endTime": "...",
    "endTimeUnset": true
  },
  "acl": {
    "aclId": "...",
    "hiddenLink": {},
    "expired": true,
    "entryCount": 0,
    "entries": [
      {
        "principalId": "...",
        "systemId": 0,
        "aclEntryId": "...",
        "aclId": "...",
        "rights": 0,
        "rightNames": [
          "..."
        ],
        "maxUsage": 0,
        "userRight": 0,
        "startTime": "...",
        "startTimeUnset": true,
        "endTime": "...",
        "endTimeUnset": true
      }
    ]
  },
  "detail": "..."
}

`400`

BAD_REQUEST. Includes sending rights, which this route refuses by name -- see the warning above.

`401`

No live session, a DPoP proof that did not verify, or a certificate session whose certificate the key server now refuses.

SESSION_NOT_FOUND -- the credential names no session this Gateway holds. SESSION_EXPIRED -- it aged out. Both carry reauth: true; obtain a new credential rather than retrying.

PROOF_* -- the sender constraint refused. See the DPoP section of this document for the full table; PROOF_MALFORMED is a 400 and PROOF_REPLAY_CACHE_FULL a 503, and the rest are here.

SCOPED_CREDENTIAL_EXPIRED -- a scoped browser credential passed its fixed lifetime. Use does not extend it: an idle timeout would be refreshed by exactly the traffic a stolen handle produces.

CERTIFICATE_REVOKED -- on a session established by certificate login, the key server re-checks the certificate that session was established with on its operations, and it is now named by revocation evidence (ADR 0115). detail is the key server's sentence. Every later operation of the session is refused the same way; log in with a different certificate.

`403`

OBJECT_NOT_IN_CREDENTIAL_SCOPE or ACCESS_DENIED.

`404`

ACL_NOT_FOUND -- and no removal was attempted.

`409`

NOT_VERIFIED -- the entry is still present in the read-back.

`500`

A fault rather than a refusal.

OP_FAILED is the catch-all: the key server refused in words that match no classified pattern, so the Gateway cannot say more than that the operation did not happen. Some key server refusals that are conceptually a caller error arrive here rather than as a 4xx, because the wire carries no distinguishing code -- where a route can recognise one from its message it maps it, and each such mapping is documented on the operation.

`502`

READBACK_FAILED.

`503`

A capacity ceiling or a missing deployment prerequisite. retryable says which.

A scope of session or process names the ceiling that was hit, and the response carries Retry-After.

BUILD_NOT_ADMITTED (scope: process, retryable: true, Retry-After): the key server does not admit this Gateway's client build. Every key-server connection the Gateway opens attests the signed release it runs (TE_RELEASE_MANIFEST) right after it authenticates; while that attestation is refused -- the release is not registered at the key server's code-signing level, the level was raised under it, or the installed files no longer match the signed manifest -- every route but GET /api/health and GET /api/ready answers this, and detail names the cause. It is never a 401 or a 403: no credential or role of the caller's is at fault. The Gateway re-attempts on a timer and recovers without a restart once the key server admits it; GET /api/ready says when.

Error handling

Every failure answers JSON carrying at least code and detail. Match on code — detail is written for a human debugging the call and its wording is not part of the contract. See the error model.

Status	Meaning
`400`	`BAD_REQUEST`. Includes sending `rights`, which this route refuses by name -- see the warning above.
`401`	No live session, a DPoP proof that did not verify, or a certificate session whose certificate the key server now refuses. `SESSION_NOT_FOUND` -- the credential names no session this Gateway holds. `SESSION_EXPIRED` -- it aged out. Both carry `reauth: true`; obtain a new credential rather than retrying. `PROOF_*` -- the sender constraint refused. See the DPoP section of this document for the full table; `PROOF_MALFORMED` is a `400` and `PROOF_REPLAY_CACHE_FULL` a `503`, and the rest are here. `SCOPED_CREDENTIAL_EXPIRED` -- a scoped browser credential passed its fixed lifetime. Use does not extend it: an idle timeout would be refreshed by exactly the traffic a stolen handle produces. `CERTIFICATE_REVOKED` -- on a session established by certificate login, the key server re-checks the certificate that session was established with on its operations, and it is now named by revocation evidence (ADR 0115). `detail` is the key server's sentence. Every later operation of the session is refused the same way; log in with a different certificate.
`403`	`OBJECT_NOT_IN_CREDENTIAL_SCOPE` or `ACCESS_DENIED`.
`404`	`ACL_NOT_FOUND` -- and no removal was attempted.
`409`	`NOT_VERIFIED` -- the entry is still present in the read-back.
`500`	A fault rather than a refusal. `OP_FAILED` is the catch-all: the key server refused in words that match no classified pattern, so the Gateway cannot say more than that the operation did not happen. Some key server refusals that are conceptually a caller error arrive here rather than as a `4xx`, because the wire carries no distinguishing code -- where a route can recognise one from its message it maps it, and each such mapping is documented on the operation.
`502`	`READBACK_FAILED`.
`503`	A capacity ceiling or a missing deployment prerequisite. `retryable` says which. A `scope` of `session` or `process` names the ceiling that was hit, and the response carries `Retry-After`. `BUILD_NOT_ADMITTED` (`scope: process`, `retryable: true`, `Retry-After`): the key server does not admit this Gateway's client build. Every key-server connection the Gateway opens attests the signed release it runs (`TE_RELEASE_MANIFEST`) right after it authenticates; while that attestation is refused -- the release is not registered at the key server's code-signing level, the level was raised under it, or the installed files no longer match the signed manifest -- every route but `GET /api/health` and `GET /api/ready` answers this, and `detail` names the cause. It is never a `401` or a `403`: no credential or role of the caller's is at fault. The Gateway re-attempts on a timer and recovers without a restart once the key server admits it; `GET /api/ready` says when.

Authentication​

Request​

Responses​

200​

400​

401​

403​

404​

409​

500​

502​

503​

Error handling​