DOCS / CONCEPTS / REVOCATION
Revocation
Revocation changes active authority. STACK writes the revoked state synchronously. The next STACK-verified call rejects the Passport with PASSPORT_REVOKED.
This statement applies to online STACK verification. An offline signature-only verifier cannot see live revocation. It must call POST /v1/passports/verify, receive revocation through a trusted integration, or accept the Passport until its expiry.
Revocation scopes
- Single Passport by JTI. Delegated descendants are revoked with it.
- All active Passports for one agent.
- All Passports in one session chain.
- All active Passports for the operator. This requires explicit confirmation.
- All active Passports that carry one revoked identity claim.
State changes
- PostgreSQL records revoked_at and the reason.
- Redis receives revoked:<jti> with a TTL bounded by the Passport lifetime.
- STACK publishes an internal revocation event for cache invalidation.
- A single-Passport revoke writes the root revocation and one cascade audit entry for each delegated child.
Triggers
- Operator API, MCP, SDK, CLI, or Console action.
- Agent, session, or operator emergency action.
- Service disconnection or identity-claim expiry when identity_auto_revoke is enabled.
- Mission and detector policies that explicitly revoke authority.
Emergency revoke
bash
curl -X POST https://api.getstack.run/v1/passports/revoke-all \
-H "Authorization: Bearer $STACK_TOKEN" \
-H "Content-Type: application/json" \
-d '{"confirm":true,"reason":"credential exposure"}'Passport revocation does not rotate an OAuth token or API key already copied outside STACK. Revoke that credential at its upstream provider.