Skip to navigation
API ReferenceGrants and Approvals

Kill switch — revoke the principal

Sponsor token required. Revokes the principal identified by sponsorId + agentId within the sponsor’s tenant: every later check for that principal is DENY, even under an allow policy, until POST /v1/reinstate undoes it. Use it the moment an agent looks compromised or a runaway loop starts issuing checks. Revocation itself writes a REVOKE receipt, so the kill-switch action is in the audit log too.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Headers

AuthorizationstringRequired

Bearer <sponsor token>.

Request

This endpoint expects an object.
sponsorIdstringRequired
The human sponsor on whose behalf the agent acts.
agentIdstringRequired
The agent to revoke.
reasonstringOptional
Recorded in the revocation and the REVOKE receipt. Defaults to 'revoked by sponsor'.

Response

Principal revoked.

Errors

400
Bad Request Error
401
Unauthorized Error