Revoke a user's authenticator
DELETE /v1/users/{user_id}/authenticators/{authenticator_id} · permission user-credentials:write
Revokes one authenticator, passkeys included. revoked_by becomes admin:<actor> and revoke_reason becomes admin_removed. If the authenticator is already revoked nothing changes and the call still returns 204. The user's sessions are not closed. The user is notified and the action is written to the management audit log.
Request
| Parameter | In | Required | Description |
|---|---|---|---|
user_id |
path | yes | User id, prefixed usr_. |
authenticator_id |
path | yes | Authenticator id, prefixed cred_. |
The request takes no body.
Response
204 No Content, also when the authenticator was already revoked.
Errors
Every error is an application/problem+json body with a stable code.
| HTTP | code |
When |
|---|---|---|
| 404 | not_found |
The user or the authenticator does not exist in this environment, the authenticator does not belong to this user, or an id is malformed. |
| 401 | unauthenticated |
The API key is missing, invalid or revoked. |
| 403 | insufficient_permissions |
The key lacks the user-credentials:write permission. |
| 429 | rate_limited |
The rate limit was exceeded; honor Retry-After. |
| 503 | service_unavailable |
A dependency is temporarily unavailable; retry later. |
Example
curl -X DELETE https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/authenticators/cred_0a1b2c3d4e5f6g7h8j9k0m1n2p \
-H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
Personal data
This endpoint carries personal data: credentials. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.