{
  "lexicon": 1,
  "id": "com.publicdomainrelay.temp.cluster.revokeIdentity",
  "defs": {
    "main": {
      "type": "procedure",
      "description": "Revoke an identity's access: write the deny record FIRST, then delete the ServiceAccount and the name-keyed artifacts, and leave the grant record in a terminal Revoked state rather than deleting it. The order is the whole design - a revocation that only deletes objects is a ten-second interruption, because getKubeconfig is create-on-read and would re-arm the identity on the next call. The principal comes from the VERIFIED token's iss and never from this input. Answers 202: propagation is a controller's work plus the authenticator's own latency, so a synchronous response would be dishonest.",
      "input": {
        "encoding": "application/json",
        "schema": {
          "type": "object",
          "properties": {
            "did": {
              "type": "string",
              "format": "did",
              "description": "The identity to revoke. Absent or equal to the caller's own DID means self-revocation. Any other value is an operator revocation and requires the caller's DID to be on the operator allowlist."
            },
            "name": {
              "type": "string",
              "description": "The cluster label to revoke on. Absent means every cluster of the account, including clusters created after this call - the account-level deny is the fan-out root and is reachable while every cluster is COLD."
            }
          }
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "type": "object",
          "required": ["revoked"],
          "properties": {
            "revoked": {
              "type": "array",
              "items": { "type": "ref", "ref": "#identityState" }
            }
          }
        }
      },
      "errors": [
        { "name": "InvalidRequest", "description": "did is not a DID, or name is not a legal RFC-1123 label within 63 characters." },
        { "name": "Unauthorized", "description": "Missing or invalid service-auth token. Also returned when the token's aud is not this service or its lxm is not this method." },
        { "name": "Forbidden", "description": "did names an identity other than the caller's, and the caller is not on the operator allowlist. Not retryable." },
        { "name": "ClusterNotFound", "description": "name was given and this account has no cluster of that name." }
      ]
    },
    "identityState": {
      "type": "object",
      "required": ["name", "state"],
      "properties": {
        "name": { "type": "string", "description": "The cluster label, or empty for an account-level revocation." },
        "state": {
          "type": "string",
          "knownValues": ["RevocationPending", "Revoked"],
          "description": "RevocationPending is the alarm, not a failure: the deny is already written and the identity is already refused, while the controller works through the deletions. Revoked is terminal and survives until its cluster does."
        }
      }
    }
  }
}