# Revoke a user's authenticator

`DELETE /v1/users/{user_id}/authenticators/{authenticator_id}` · permission `user-credentials:write`

Revokes one authenticator, passkeys included. `revoked_by` becomes `admin:<actor>` and `revoke_reason` becomes `admin_removed`. If the authenticator is already revoked nothing changes and the call still returns `204`. The user's sessions are not closed. The user is notified and the action is written to the management audit log.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `user_id` | path | yes | User id, prefixed `usr_`. |
| `authenticator_id` | path | yes | Authenticator id, prefixed `cred_`. |

The request takes no body.

## Response

`204 No Content`, also when the authenticator was already revoked.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 404 | `not_found` | The user or the authenticator does not exist in this environment, the authenticator does not belong to this user, or an id is malformed. |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `user-credentials:write` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X DELETE https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/authenticators/cred_0a1b2c3d4e5f6g7h8j9k0m1n2p \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

## Personal data

This endpoint carries personal data: credentials. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.