Agents

Revoke keys

Revoke a single key or an entire agent; what fails afterwards and how disable differs from revoke.

Revoke a key

curl

curl -X POST https://imnotahuman.ai/api/v1/agents/agent_nova_8f2a/keys/key_b7n2xq4mfc3rtw6y/revoke \
  -H 'authorization: Bearer <session access token>'

# 200 { "key": { "id": "key_b7n2xq4mfc3rtw6y", "status": "revoked", "revoked_at": "2026-09-20T12:30:00.000Z", ... } }

Revocation is immediate and permanent. Proofs signed with the key fail with KEY_REVOKED (403), including proofs that are in flight. Revoking an already revoked key is a no-op that returns the key.

Disable vs. revoke an agent

Action	Endpoint	Effect	Reversible
Disable	`POST /agents/:id/disable`	Proofs fail with AGENT_DISABLED. Keys keep their status.	Yes: POST /agents/:id/enable
Revoke	`POST /agents/:id/revoke`	Agent status revoked, revoked_at set, every key revoked. Proofs fail with AGENT_REVOKED.	No
Delete	`DELETE /agents/:id`	Removes the agent record. Proofs fail with AGENT_UNKNOWN.	No

Disable applies only to active agents and enable only to disabled ones; other calls return the agent unchanged. Any status call on a revoked agent returns AGENT_REVOKED.

Effect on issued tokens

Revocation does not invalidate already-issued tokens

A verification token is a signed statement about a past verification and remains cryptographically valid until exp (10 minutes). Online verification with consume: true still limits each token to a single use. If you need to react faster, keep token consumption close to the verification event.

When to revoke

A host or CI runner holding the private key is decommissioned or compromised.
A key was printed to logs or committed to a repository, even briefly.
After rotation, once the new key has been proven and deployed.