Revoke a support access grant
DELETE /v1/support-access-grants/{grant_id} · permission support-access-grants:write
Revokes a support access grant before it expires: revoked_at is set, staff access based on it ends and a support_access_grant.revoked event is published. The record is kept for audit. Revoking a grant that is already revoked or expired changes nothing and still returns 204. Only from the dashboard by an owner or admin who signed in again within the last 5 minutes; API keys and machine clients receive 403 insufficient_permissions.
Request
| Field | Type | Required | Description |
|---|---|---|---|
grant_id |
string | yes | Grant ID (sag_…). |
No request body.
Response
204 No Content.
Errors
| HTTP | code | When |
|---|---|---|
| 404 | not_found |
The grant does not exist or belongs to another environment. |
| 403 | insufficient_permissions |
The request was not made from the dashboard by an owner or admin, or the credential lacks the required permission. |
| 401 | unauthenticated |
The credential is missing, invalid or revoked. |
| 429 | rate_limited |
The rate limit was exceeded; retry after the Retry-After period. |
| 503 | service_unavailable |
A dependency is temporarily unavailable; retry after the Retry-After period. |
Example
Create and revoke are dashboard actions. The request the dashboard sends:
DELETE /v1/support-access-grants/sag_01j9xk3m7q8r2s4t6v8w0y2z4a