Revoke, but retain, a provider key
A revoked key verifies no further receipts or attestations, and a grant admitted by an attestation under it can no longer be claimed. Its metadata remains, so what was recorded against it stays explicable.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Path Parameters
1 <= length <= 200Query Parameters
Optional when the authenticated API key is already bound to an organization.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/v1/execution/provider-keys/string"{ "service": "decionis", "kid": "string", "revoked": true}Register a public key for effect receipts, presence attestations, edge usage reports or signed signals POST
Registers only the public half of the Ed25519 key a system of record signs effect receipts with, or a presence provider signs presence attestations with, under the issuer it names in `iss`. `purpose` (default `effect_receipt`) says which: a key only ever verifies its own purpose, so an effect-receipt key never verifies an attestation and an attestation key never verifies a receipt. An edge installation registers its usage-report key with purpose `usage_report` and its installation id as `issuer`. A producer of signed signals (a card-presence provider's Tap to Authenticate, say) registers its key with purpose `signed_signal` and the producer id the signals name as `iss` as `issuer`; an admitted presence provider's JWKS keys sign its signals without registration. Private key material is rejected. Registering the same `kid` again replaces the key (and its purpose) and clears its revocation. Requires policy:write or org:* scope.
The directory of presence providers a policy may name GET
Third parties that prove a person was present for an intent, such as a card issuer's partner proving the cardholder tapped their own card (method CARD_TAP). Decionis operates the directory; each entry names the provider's attestation `iss` and the JWKS it publishes its Ed25519 keys at. An organisation trusts a provider only once it admits it (PUT /v1/execution/presence-providers/{provider_id}/admission). Requires policy:read, policy:write or org:* scope.