Skip to main content

Revoke Credentials

Securely revoke and delete stored credentials.

DELETE /api/credentials/{id}

Authorization​

  • Customer: Can revoke their own credentials.
note

This route resolves the caller's customer profile and verifies ownership; callers without a customer profile receive 403.

Path Parameters​

ParameterTypeRequiredDescription
idstringYesCredential ID

Response​

{
  "message": "Credential revoked and deleted successfully"
}

Side Effects​

Revoking credentials:

  1. Deletes the secret from Doppler
  2. Marks the record revokedAt and soft-deletes it
  3. Writes a revoke entry to the credential access log

Security​

The secret is removed from Doppler and the record is soft-deleted; the database soft-delete preserves the audit trail while the secret store no longer holds the value.

danger

Credential revocation is permanent and irreversible. Ensure you have new credentials ready before revoking.

Example Request​

curl -X DELETE "https://api.traces.io/api/credentials/cred_abc123" \
  -H "Authorization: Bearer <token>"

Error Responses​

400 Bad Request​

Credential already revoked:

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "Credential has already been revoked"
  }
}

403 Forbidden​

Customer trying to revoke another's credentials:

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Access denied"
  }
}

404 Not Found​

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Credential not found"
  }
}