Revoke Client Certificate
Revoke a device certificate, for example when a device is lost or stolen. Every endpoint refuses it from the device's next request or connection, in every region. A WebSocket or other stream that is already open stays open until it closes.
Revoking can't be undone: to let the device in again, issue a new certificate. Revoking a certificate that is already revoked changes nothing and answers 200. It works whatever your plan, so a certificate can always be revoked. The CLI does the same with ngris client-cert revoke <certificate_uuid>.
Path parameters
uuid string (uuid) Req
The certificate's
uuid from the CA's certificates. Device names can repeat, so check the serial and expiry to pick the right one.Request body
reason string
Optional. Why, for your records: one line, at most 255 characters. The body may be empty.
Response (200 OK)
The certificate object, now with "status": "revoked", revoked_at and revoke_reason.
Errors
400 Bad Request
A reason longer than 255 characters or over more than one line, or a body that isn't JSON.
401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks the
cert:update permission in the active account.404 Not Found
The certificate doesn't exist or belongs to another account.
Request
curl -X POST "https://api.ngris.com/v1/client-certificates/019b2c41-7d0e-7f3a-9c5e-2a6b8d4f1e07/revoke" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{"reason": "Laptop stolen"}'
Response — 200 OK
{
"uuid": "019b2c41-7d0e-7f3a-9c5e-2a6b8d4f1e07",
"name": "laptop-anna",
"serial": "5b1e0c9a3f7d42e8b6a1c0d9e8f7a6b5",
"fingerprint_sha256": "9a8b7c6d5e4f30211203f4e5d6c7b8a99a8b7c6d5e4f30211203f4e5d6c7b8a9",
"subject": "CN=laptop-anna",
"public_key_alg": "rsa-2048",
"not_before": "2026-10-29T09:55:00Z",
"not_after": "2027-01-27T10:00:00Z",
"delivery": "csr",
"status": "revoked",
"revoked_at": "2026-11-02T08:30:00Z",
"revoke_reason": "Laptop stolen",
"created_via": "cli",
"created_at": "2026-10-29T10:00:00Z",
"client_ca_uuid": "019b2c40-1a2b-7c3d-8e4f-5a6b7c8d9e0f",
"revoked_by_user_uuid": "019a52c2-ca1e-78ba-ab5c-50362cc29134",
"created_by_user_uuid": "019a52c2-ca1e-78ba-ab5c-50362cc29134"
}
Was this helpful?