Revokes an access record. Transitions the record to REVOKED state with a
revoked-at timestamp. Records are retained for audit — not deleted.
For consent records this represents customer withdrawal of consent. For non-consent records this represents the Controller removing their access registration (e.g. LIA no longer applicable, contract ended, statutory authority lapsed).
After revocation GET /access-records/{ak} returns the record in REVOKED
state. Data Providers must deny access for any non-ACTIVE record.
JWT from GET /auth/token. Pass as Authorization: Bearer <token>. Expires after 7200s.
The access key to revoke. Unique opaque identifier for an access record, issued by the register on creation. Treat as a secret — possession enables access verification.
^ak_[0-9a-f]{24}$"ak_691df0c788ca043403b7fa90"
Access record revoked. Record retained in REVOKED state.
Unique opaque identifier for an access record, issued by the register on creation. Treat as a secret — possession enables access verification.
^ak_[0-9a-f]{24}$"ak_691df0c788ca043403b7fa90"
UTC timestamp of revocation.
"2025-06-01T14:22:00Z"