Revoke a Core key for an Accounts-authorized workspace
Disabled until the dedicated Accounts service credential is configured. Accounts authorizes current owner/admin membership and Commerce access, then signs a command bound to its exact organization, workspace, user, environment and protocol purpose. Core requires a synchronized existing workspace projection, verifies the signature through the configured Accounts JWKS and checks authorization expiry after lock waits. Commands expire within 60 seconds; issued_at may be at most 5 seconds ahead. command_id is globally immutable across actors, workspaces and actions; only authorization timestamps may change on retry. JSON only, no query parameters, cookies or Origin header. This creates no native platform connection and grants no ERP execution authority. Revokes only the exact key in the signed workspace credential namespace. Repeating the same authorized command is idempotent. Revocation does not modify a native provider connection.
Authorization
AccountsWorkspaceCredentialService Private Accounts-to-Core service credential: ACCOUNTS_WORKSPACE_CREDENTIAL_SERVICE_TOKEN. Each request also requires fresh Accounts Ed25519 command evidence. Merchant keys, product sessions, native provider credentials and other service credentials do not authorize this endpoint.
In: header
Request Body
application/json
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/internal/workspace-credentials/revoke" \ -H "Content-Type: application/json" \ -d '{ "payload": { "version": "accounts-workspace-credential-v1", "command_id": "7d510d78-7444-4252-aeac-9e473949661e", "purpose": "protocol", "account_org_id": "string", "account_workspace_id": "string", "account_user_id": "string", "product": "commerce", "environment": "sandbox", "role": "owner", "issued_at": "2019-08-24T14:15:22Z", "authorization_expires_at": "2019-08-24T14:15:22Z", "action": "revoke", "key_id": "1e779c8a-6786-4c89-b7c3-a6666f5fd6b5" }, "evidence": { "algorithm": "Ed25519", "key_id": "string", "payload_sha256": "string", "signature": "string" } }'{ "version": "accounts-workspace-credential-v1", "command_id": "7d510d78-7444-4252-aeac-9e473949661e", "account_org_id": "string", "account_workspace_id": "string", "product": "commerce", "environment": "sandbox", "status": "revoked", "credential": { "key_id": "1e779c8a-6786-4c89-b7c3-a6666f5fd6b5", "label": "string", "role": "MEMBER", "scopes": [ "decision:read", "decision:write" ], "created_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z" }}List Core key metadata for an Accounts-authorized workspace POST
Disabled until the dedicated Accounts service credential is configured. Accounts authorizes current owner/admin membership and Commerce access, then signs a command bound to its exact organization, workspace, user, environment and protocol purpose. Core requires a synchronized existing workspace projection, verifies the signature through the configured Accounts JWKS and checks authorization expiry after lock waits. Commands expire within 60 seconds; issued_at may be at most 5 seconds ahead. command_id is globally immutable across actors, workspaces and actions; only authorization timestamps may change on retry. JSON only, no query parameters, cookies or Origin header. This creates no native platform connection and grants no ERP execution authority. Returns at most 100 Accounts-provisioned credentials with a truncation indicator. Metadata contains no raw key or provider secret. Legacy connector credentials are outside this namespace.
Verify an Accounts-authorized native READ registration POST
Default off. Accounts authorizes the current owner/admin of the exact existing Commerce workspace and signs a command. Core checks current Accounts JWKS and the SYNCED human workspace projection; no org, membership, merchant ADMIN key or Marketplace purchase is created. A command lease lasts at most 30 seconds, with at most 5 seconds future clock skew. JSON only; no query, Origin or Cookie. command_id has immutable semantic content; retries may refresh only issued_at and authorization_expires_at. No route executes a commerce or payment transaction. Requires fresh Entra tenant identity plus an exact operator-managed assignment to this Accounts/Core workspace, tenant, BC environment and company. Provider proof must be verified within 10 minutes of command issue and outlive its lease. Core selects its managed application and reads only the exact company and native guardSettings. Configured/enabled guard state is observed separately from READ permission. Atomic activation records an Accounts enrollment grant with can_configure=false. Reverification pins the existing enrollment/connection/revision and increments the revision. A successful immutable retry returns the original receipt without another provider read.