Kill switch — revoke the principal | Writ

Sponsor token required. Revokes the principal identified by sponsorId + agentId within the sponsor’s tenant: every later check for that principal is DENY, even under an allow policy, until POST /v1/reinstate undoes it. Use it the moment an agent looks compromised or a runaway loop starts issuing checks. Revocation itself writes a REVOKE receipt, so the kill-switch action is in the audit log too.

**Sponsor token** required. Revokes the principal identified by sponsorId + agentId within the sponsor's tenant: **every later check for that principal is DENY, even under an allow policy**, until `POST /v1/reinstate` undoes it. Use it the moment an agent looks compromised or a runaway loop starts issuing checks. Revocation itself writes a REVOKE receipt, so the kill-switch action is in the audit log too.

Authentication

AuthorizationBearer

Your Writ API key (writ_…) as an Authorization Bearer header. The sponsor token (writ_sp_…) is a separate credential used only for grants, revokes, and reinstate — it goes in the same Authorization header on those endpoints. In the Fern docs playground, paste the key here; it is stored in this browser only.

Your Writ API key (writ_...) as an Authorization Bearer header. The sponsor token (writ_sp_...) is a separate credential used only for grants, revokes, and reinstate — it goes in the same Authorization header on those endpoints. In the Fern docs playground, paste the key here; it is stored in this browser only.

Request

This endpoint expects an object.

sponsorIdstringRequired

The human sponsor on whose behalf the agent acts.

agentIdstringRequired

The agent to revoke.

reasonstringOptional

Recorded in the revocation and the REVOKE receipt. Defaults to 'revoked by sponsor'.

Response

Principal revoked.

Errors

400

Bad Request Error

401

Unauthorized Error

Authentication

Headers

Request

Response

Errors