Revoke Signing Credential

Revokes a device's signing credentials — for example when the user reports a lost or stolen phone, or you detect fraud. A revoked key is never reactivated; to sign again the device registers a new key with Init Signing Credential and Confirm Signing Credential.

Signing credentials belong to the device, not to a FaceAuthen user: deleting a face profile with Delete Face Authen does not revoke any key. Call this endpoint when a device's keys should stop working.

Endpoint

POST /v1/signing-credential/revoke
Content-Type: application/json

{
  "device_id": "device_00000001",
  "key_id": "<KEY_ID>"
}

Parameters:

Param	Type	Required	Default	Description
device_id	string	Yes	—	The device ID sent to Init. Must not be blank, must not start or end with whitespace, and must be at most 128 characters.
key_id	string	No	—	The key to revoke. Omit it to revoke all of the device's ACTIVE keys ("lost phone").

Returns: RevokeSigningCredentialResponse

Sample Request

curl --location '<BASE_URL>/v1/signing-credential/revoke' \
  --header 'Authorization: ATV <ACCESS_ID>:<SIGNATURE>' \
  --header 'X-TV-Timestamp: <TIMESTAMP>' \
  --header 'Content-Type: application/json' \
  --data '{
    "device_id": "device_00000001",
    "key_id": "<KEY_ID>"
  }'

Response

{
  "success": true,
  "code": 0,
  "message": "Success",
  "data": {
    "request_id": "cfc7b8d5-f2e2-437b-80e5-d600dfad26e2",
    "revoked": [
      {
        "key_id": "<KEY_ID>",
        "status": "REVOKED",
        "revoked_at": "2026-09-30T02:10:00Z"
      }
    ]
  },
  "errors": []
}

Field	Type	Description
data.request_id	string	The request ID, used for tracing.
data.revoked	array	Keys revoked by this call. Empty when there was nothing ACTIVE to revoke.
data.revoked[].key_id	string	Signing key ID (UUID).
data.revoked[].status	string	Always REVOKED.
data.revoked[].revoked_at	string	Revocation time (RFC 3339).
errors	array	Detail of each failure. Empty on success.

• Idempotent. Revoking a key that is already revoked or expired succeeds with an empty revoked array.
• A key_id that does not belong to device_id in your tenant returns signing_credential_not_found.

WARNING

Call this endpoint from your backend only, with your Access Key. The SDK's Bearer token is rejected with 403101.

Errors

Code	Message
2001010	Access ID not found in the system.
2009004	Signing credential not found.
401100	Unauthorized action. You do not have permission to perform this action.
403101	Permission denied. You do not have permission to perform this action.
4001000	Input parameter violates a constraint.
4001001	The X-TV-Timestamp header is expired. Please provide a newer timestamp.
5001000	Some unexpected error occurs while processing the request.

Code	Description
access_id_not_found	Access ID not found in the system.
signing_credential_not_found	key_id does not exist for this device in your tenant.
access_denied_exception	Missing or invalid Access Key or signature.
permission_denied_exception	Called with an SDK Bearer token; only the Access Key is allowed.
invalid_parameter_exception	device_id is missing, blank, longer than 128 characters, or starts or ends with whitespace.
request_time_too_skewed	The X-TV-Timestamp header is expired, need a newer one.
internal_server_error	Some unexpected error occurs while processing the request.

Next Steps

• Get Active Signing Credential — confirm no ACTIVE key is left
• Init Signing Credential — register a new key on the new phone