Skip to content
Fleet Manager

Revoke device certificate

POST
/api/v1/devices/{deviceId}/certificates/{certificateId}/revoke
 
curl --request POST \
  --url http://localhost:3000/api/v1/devices/550e8400-e29b-41d4-a716-446655440000/certificates/550e8400-e29b-41d4-a716-446655440001/revoke \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --header 'x-user-id: example' \
  --data '{ "reason": "Key compromise", "notes": "Device was stolen from warehouse" }'

Revokes a device certificate. This action cannot be undone.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
deviceId
required
string format: uuid
Example 
550e8400-e29b-41d4-a716-446655440000

Device UUID

certificateId
required
string format: uuid
Example 
550e8400-e29b-41d4-a716-446655440001

Certificate UUID

Header Parameters

Section titled “Header Parameters ”
x-user-id
required
string

Request Body required

Section titled “Request Body required ”
Media type application/json
object
reason
required

Reason for revoking the certificate

string
Allowed values: Key compromise CA compromise Affiliation changed Superseded Cessation of operation Certificate hold Other
Example 
Key compromise
notes

Additional notes about the revocation (required if reason is “Other”)

string
<= 1000 characters
Example 
Device was stolen from warehouse

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Certificate revoked successfully

Media type application/json
object
id
required

Unique certificate identifier (UUID)

string format: uuid
deviceId
required

Device ID this certificate belongs to

string format: uuid
fingerprint
required

SHA-256 fingerprint of the certificate

string
subject
required

Certificate subject (Distinguished Name)

string
issuer
required

Certificate issuer (Distinguished Name)

string
notBefore
required

Certificate validity start date

string format: date-time
notAfter
required

Certificate validity end date (expiration)

string format: date-time
revoked
required

Whether the certificate has been revoked

boolean
revokedAt

Date when the certificate was revoked

string format: date-time
revokeReason

Reason for certificate revocation

string
Allowed values: Key compromise CA compromise Affiliation changed Superseded Cessation of operation Certificate hold Other
createdAt
required

Timestamp when the certificate was issued

string format: date-time
Example 
{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "deviceId": "550e8400-e29b-41d4-a716-446655440001",
  "fingerprint": "A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2",
  "subject": "CN=edge-device-001,O=Margo WFM,OU=Devices",
  "issuer": "CN=Margo Root CA,O=Margo WFM,OU=Certificate Authority",
  "notBefore": "2024-01-01T00:00:00Z",
  "notAfter": "2025-01-01T00:00:00Z",
  "revoked": false,
  "revokedAt": "2024-06-01T00:00:00Z",
  "revokeReason": "Key compromise",
  "createdAt": "2024-01-01T00:00:00Z"
}

400

Section titled “400 ”

Bad Request - Invalid revocation reason

401

Section titled “401 ”

Unauthorized - Invalid or missing authentication

403

Section titled “403 ”

Forbidden - Insufficient permissions (operator or admin)

404

Section titled “404 ”

Device or certificate not found, or certificate already revoked