# Revoke a support access grant

`DELETE /v1/support-access-grants/{grant_id}` · permission `support-access-grants:write`

Revokes a support access grant before it expires: `revoked_at` is set, staff access based on it ends and a `support_access_grant.revoked` event is published. The record is kept for audit. Revoking a grant that is already revoked or expired changes nothing and still returns `204`. Only from the dashboard by an `owner` or `admin` who signed in again within the last 5 minutes; API keys and machine clients receive `403 insufficient_permissions`.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `grant_id` | string | yes | Grant ID (`sag_…`). |

No request body.

## Response

`204 No Content`.

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The grant does not exist or belongs to another environment. |
| 403 | `insufficient_permissions` | The request was not made from the dashboard by an `owner` or `admin`, or the credential lacks the required permission. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

Create and revoke are dashboard actions. The request the dashboard sends:

```http
DELETE /v1/support-access-grants/sag_01j9xk3m7q8r2s4t6v8w0y2z4a
```