Revoke an agent

Revocation is final. A revoked agent cannot be reactivated; register a new one instead. To pause an agent, use the kill switch instead.

DeactivateCopy Anchor Link

curl -X DELETE https://api.aytwin.ai/api/v1/agents/$AGENT_ID \
  -H "Authorization: Bearer $AY_OIDC_TOKEN"

AY performs three steps in this order:

1. Status. The agent becomes deactivated, with the actor and the time. From here on every authenticated call fails with 401 AGENT_INACTIVE, the passport's status list bit shows revoked, and GET /api/v1/identity/resolve reports deactivated: true.
2. DID log. A final entry with deactivated: true is appended to did.jsonl, signed with the update key. External resolvers see the revocation from the log alone. If this step fails temporarily, step 1 stays in effect and the log entry is written later.
3. Identity provider. The Zitadel machine user is deactivated.

The response reports what happened:

{ "message": "Agent deactivated", "id": "…", "status": "deactivated", "log_deactivated": true }

The DID document and the log stay public. The history of a revoked agent remains verifiable.

Business suspensionCopy Anchor Link

When AY suspends a business or revokes its verification, the Zitadel users of all its agents are deactivated, and every call fails with 403 OWNER_NOT_VERIFIED. When the business is verified again, only agents that are still active get their credential back.

Emergency revocation by AYCopy Anchor Link

If an owner cannot act, for example after a key compromise, an AY operator can revoke the agent. The operator and the reason are recorded on the agent. Contact support with the agent DID.