Revoke a credential.

DELETE

/v1/iam/principals/{id}/credentials/{cid}

const url = 'https://example.com/v1/iam/principals/example/credentials/example';
const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request DELETE \
  --url https://example.com/v1/iam/principals/example/credentials/example \
  --header 'Authorization: Bearer <token>'

Authorizations

bearerAuth

Parameters

Path Parameters

required

string

Principal id.

cid

required

string

Credential id.

Responses

204

No content

default

Structured error envelope (SPEC-DATA-0006): {"errors": [{"domain", "scope", "target", "code", "message"}, ...]}. domain (added #950 D9) names the subsystem that produced the entry (data, metadata, apply, git, auth, iam, hfx, or api for a transport-level failure with no domain error behind it) and is always present.

application/json

The top-level response body. Wraps a non-empty list of [ErrorEntry].

object

errors

required

The error entries making up the envelope. Always non-empty.

Array<object>

One entry in the error envelope.

Carries a [Domain] naming the subsystem that produced it, an anchoring [ErrorScope], an optional target that disambiguates within the scope, a stable SCREAMING_SNAKE_CASE code, and a human-readable English message. See SPEC-DATA-0006 for the full envelope contract.

object

code

required

Machine-readable, stable, SCREAMING_SNAKE_CASE identifier.

string

domain

required

Which subsystem produced this entry. Always serialized.

One of:

data::error::DataError – record CRUD, validation, queries.

string

Allowed value: data

server::routes::metadata::error::MetadataError – the metadata write API (module/object/field/screen PUT and POST).

string

Allowed value: metadata

server::apply::ApplyError – the metadata apply/plan pipeline.

string

Allowed value: apply

server::git::GitError – the git-backed metadata repository.

string

Allowed value: git

auth::error::AuthError – JWT and credential authentication.

string

Allowed value: auth

server::routes::iam::error::IamError – principal and credential management (IAM handlers still emit Domain::Data for genuine request-body field validation, which stays DataError).

string

Allowed value: iam

server::routes::hfx::error::HfxError – HFX parse/emit.

string

Allowed value: hfx

Module packages (.hfmod, #1165): package format, signature and compatibility refusals, and the install lifecycle that consumes them.

string

Allowed value: module

A transport-level ApiError built directly (forbidden, not_found, internal, service_unavailable), with no <Domain>Error behind it.

string

Allowed value: api

location

Any of:

object
null

HFX source location for an HFX_PARSE entry.

Emitted as the extra location field on the entry JSON when present. The line/column are 1-based. The frame is the offending source line extracted verbatim from the input.

object

column

required

1-based column within the line, measured in UTF-16 code units of the prefix so browser-side editors can consume it directly.

integer format: uint32

frame

The offending source line text, when available.

string | null

line

required

1-based line number within the source text.

integer format: uint32

message

required

Server-authored English message. Not part of the API contract; may change across releases without notice.

string

rule

The key of the validation rule that failed, when the code is RULE_FAILED. None for all other codes. Skipped during serialization when absent so it does not appear on unrelated entries (same pattern as location).

string | null

scope

required

Anchoring category. Drives client-side rendering.

One of:

Attached to a specific request field. target is the field key.

string

Allowed value: field

Attached to the record being written or read. target is the id if known.

string

Allowed value: record

Attached to the request as a whole. target is always null.

string

Allowed value: global

target

Field key for field scope, record id for record scope, null otherwise. Always serialized, even when null.

string | null

Example

{
  "errors": [
    {
      "domain": "data",
      "scope": "field"
    }
  ]
}