chap.participant.revoke_key
chap.participant.revoke_keyRevoke a signing key after device loss or compromise, immediately refusing future signatures. Requires admin role to revoke another participant's key.
Instructions
Revoke a signing key, for example after a device is lost. Signatures presented with it are refused from then on. Revoking another participant's key requires the admin role.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kid | Yes | Key id to revoke. It is marked revoked with a timestamp and a reason, and signatures presented with it are refused from then on. A key id that is unknown is refused with -32071. | |
| from | Yes | Participant URI, e.g. 'human:alice@example.org' or 'agent:bot@local'. | |
| reason | No | Why the key was revoked, e.g. 'laptop lost'. Recorded on the key and in the audit entry. | |
| workspace | Yes | Workspace identifier, e.g. 'wsp_techcorp_support'. | |
| target_uri | Yes | Whose key is being revoked. Revoking another member's key requires the caller to hold the role 'admin'; otherwise the call is refused with -32011. |