1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
{
"lexicon": 1,
"id": "com.publicdomainrelay.temp.cluster.revokeIdentity",
"defs": {
"main": {
"type": "procedure",
"description": "Revoke an identity's access: write the deny record FIRST, then delete the ServiceAccount and the name-keyed artifacts, and leave the grant record in a terminal Revoked state rather than deleting it. The order is the whole design - a revocation that only deletes objects is a ten-second interruption, because getKubeconfig is create-on-read and would re-arm the identity on the next call. The principal comes from the VERIFIED token's iss and never from this input. Answers 202: propagation is a controller's work plus the authenticator's own latency, so a synchronous response would be dishonest.",
"input": {
"encoding": "application/json",
"schema": {
"type": "object",
"properties": {
"did": {
"type": "string",
"format": "did",
"description": "The identity to revoke. Absent or equal to the caller's own DID means self-revocation. Any other value is an operator revocation and requires the caller's DID to be on the operator allowlist."
},
"name": {
"type": "string",
"description": "The cluster label to revoke on. Absent means every cluster of the account, including clusters created after this call - the account-level deny is the fan-out root and is reachable while every cluster is COLD."
}
}
}
},
"output": {
"encoding": "application/json",
"schema": {
"type": "object",
"required": ["revoked"],
"properties": {
"revoked": {
"type": "array",
"items": { "type": "ref", "ref": "#identityState" }
}
}
}
},
"errors": [
{ "name": "InvalidRequest", "description": "did is not a DID, or name is not a legal RFC-1123 label within 63 characters." },
{ "name": "Unauthorized", "description": "Missing or invalid service-auth token. Also returned when the token's aud is not this service or its lxm is not this method." },
{ "name": "Forbidden", "description": "did names an identity other than the caller's, and the caller is not on the operator allowlist. Not retryable." },
{ "name": "ClusterNotFound", "description": "name was given and this account has no cluster of that name." }
]
},
"identityState": {
"type": "object",
"required": ["name", "state"],
"properties": {
"name": { "type": "string", "description": "The cluster label, or empty for an account-level revocation." },
"state": {
"type": "string",
"knownValues": ["RevocationPending", "Revoked"],
"description": "RevocationPending is the alarm, not a failure: the deny is already written and the identity is already refused, while the controller works through the deletions. Revoked is terminal and survives until its cluster does."
}
}
}
}
}
