Skip to content
logiccloud orchestrate

Revoke device certificate

POST
/api/v1/devices/{deviceId}/certificates/{certificateId}/revoke
curl --request POST \
  --url http://localhost:3000/api/v1/devices/550e8400-e29b-41d4-a716-446655440000/certificates/550e8400-e29b-41d4-a716-446655440001/revoke \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --header 'x-user-id: example' \
  --data '{ "reason": "Key compromise", "notes": "Device was stolen from warehouse" }'

Revokes a device certificate. This action cannot be undone.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
deviceId
required
string format: uuid
Example
550e8400-e29b-41d4-a716-446655440000

Device UUID

certificateId
required
string format: uuid
Example
550e8400-e29b-41d4-a716-446655440001

Certificate UUID

Header Parameters

Section titled “Header Parameters”
x-user-id
required
string
x-organization-id
string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
reason
required

Reason for revoking the certificate

string
Allowed values: Key compromise CA compromise Affiliation changed Superseded Cessation of operation Certificate hold Other
Example
Key compromise
notes

Additional notes about the revocation (required if reason is “Other”)

string
<= 1000 characters
Example
Device was stolen from warehouse

Responses

Section titled “Responses”

200

Section titled “200”

Certificate revoked successfully

Media typeapplication/json
object
id
required

Unique certificate identifier (UUID)

string format: uuid
deviceId
required

Device ID this certificate belongs to

string format: uuid
fingerprint
required

SHA-256 fingerprint of the certificate

string
subject
required

Certificate subject (Distinguished Name)

string
issuer
required

Certificate issuer (Distinguished Name)

string
notBefore
required

Certificate validity start date

string format: date-time
notAfter
required

Certificate validity end date (expiration)

string format: date-time
validityKnown
required

False for a legacy certificate record whose notBefore, notAfter and issuer were not read from a certificate (stored before the presented certificate was kept). Its dates are placeholders. The record refreshes when the device re-onboards.

boolean
revoked
required

Whether the certificate has been revoked

boolean
revokedAt

Date when the certificate was revoked

string format: date-time
revokeReason

Reason for certificate revocation

string
Allowed values: Key compromise CA compromise Affiliation changed Superseded Cessation of operation Certificate hold Other
createdAt
required

Timestamp when the certificate was issued

string format: date-time
Example
{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "deviceId": "550e8400-e29b-41d4-a716-446655440001",
  "fingerprint": "A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2",
  "subject": "CN=edge-device-001,O=Margo WFM,OU=Devices",
  "issuer": "CN=Margo Root CA,O=Margo WFM,OU=Certificate Authority",
  "notBefore": "2024-01-01T00:00:00Z",
  "notAfter": "2025-01-01T00:00:00Z",
  "validityKnown": true,
  "revoked": false,
  "revokedAt": "2024-06-01T00:00:00Z",
  "revokeReason": "Key compromise",
  "createdAt": "2024-01-01T00:00:00Z"
}

400

Section titled “400”

Bad Request - Invalid revocation reason

401

Section titled “401”

Unauthorized - Invalid or missing authentication

403

Section titled “403”

Forbidden - Insufficient permissions (operator or admin)

404

Section titled “404”

Device or certificate not found, or certificate already revoked