# Revoke an org agent

> The agents.revoke operation: POST /api/v1/agents/{id}/revoke in the REST API and the agents_revoke tool in the MCP server.

Revokes an agent for good: every access token is revoked at once and its credentials stop working. It stays
listed (with its audit trail) as `revoked`; create a new agent to replace it. Revoking a revoked agent changes
nothing.

## At a glance

- **REST:** `POST /api/v1/agents/{id}/revoke`
- **MCP tool:** `agents_revoke`
- **Operation ID:** `agents.revoke`
- **Scope:** Organization
- **Permission:** `agents:admin`
- **Risk tier:** `security`
- **Dry run:** Supported (send `Ownrecord-Dry-Run: true`)
- **Idempotency:** `Idempotency-Key` required
- **Modes:** Test and live
- **Authentication:** API key with the `agents:admin` scope
- **Since:** M10

## Request

### Path parameters

| Field | Type       | Description |
| ----- | ---------- | ----------- |
| `id`  | `agt_…` ID |             |

### Body

This operation takes no body.

## Response

`200 OK` with a JSON object:

| Field                               | Type                                                                                               | Description |
| ----------------------------------- | -------------------------------------------------------------------------------------------------- | ----------- |
| `id`                                | `agt_…` ID                                                                                         |             |
| `object`                            | `"agent"`                                                                                          |             |
| `orgId`                             | `org_…` ID                                                                                         |             |
| `name`                              | string                                                                                             |             |
| `description`                       | string or null                                                                                     |             |
| `contact`                           | string or null                                                                                     |             |
| `vendor`                            | string or null                                                                                     |             |
| `ownerType`                         | one of `org`, `app`                                                                                |             |
| `appInstallationId`                 | `ains_…` ID or null                                                                                |             |
| `role`                              | one of `org_admin`, `billing_admin`, `finance`, `tax_manager`, `support`, `developer`, `viewer`    |             |
| `scope`                             | object                                                                                             |             |
| `livemodeAccess`                    | boolean                                                                                            |             |
| `limits`                            | object                                                                                             |             |
| `limits.rps`                        | integer or null                                                                                    |             |
| `limits.mutationsPerDay`            | integer or null                                                                                    |             |
| `limits.amountLimits`               | array of object                                                                                    |             |
| `limits.amountLimits[].operationId` | string                                                                                             |             |
| `limits.amountLimits[].perCall`     | money or null                                                                                      |             |
| `limits.amountLimits[].perDay`      | money or null                                                                                      |             |
| `toolSets`                          | array of string                                                                                    |             |
| `status`                            | one of `active`, `paused`, `revoked`                                                               |             |
| `clientId`                          | `ocl_…` ID                                                                                         |             |
| `authMethod`                        | one of `client_secret_basic`, `client_secret_post`, `private_key_jwt`                              |             |
| `secretPrefix`                      | string or null                                                                                     |             |
| `dpopBoundAccessTokens`             | boolean                                                                                            |             |
| `scopes`                            | array of one of 84 values, e.g. `org:read`, `org:write`, `org:admin` (all in the OpenAPI document) |             |
| `createdBy`                         | string                                                                                             |             |
| `createdAt`                         | string                                                                                             |             |
| `updatedAt`                         | string                                                                                             |             |
| `pausedAt`                          | string or null                                                                                     |             |
| `revokedAt`                         | string or null                                                                                     |             |

## Examples

### Revoke an agent

```http
POST /api/v1/agents/agt_01m4ttwd3veh9apbewxheq5xh8/revoke
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
```

Response (`200`):

```json
{
  "id": "agt_01m4ttwd3veh9apbewxheq5xh8",
  "object": "agent",
  "orgId": "org_01m4ttwd3veh9apbewxheq5xh3",
  "name": "Bookkeeper",
  "description": "Prepares and files the quarterly OSS return",
  "contact": "ops@acme.example",
  "vendor": "In-house, Claude via the MCP server",
  "ownerType": "org",
  "appInstallationId": null,
  "role": "finance",
  "scope": {
    "type": "org"
  },
  "livemodeAccess": false,
  "limits": {
    "rps": null,
    "mutationsPerDay": null,
    "amountLimits": [
      {
        "operationId": "refunds.create",
        "perCall": null,
        "perDay": {
          "amount": "200000000",
          "currency": "EUR"
        }
      }
    ]
  },
  "toolSets": [],
  "status": "revoked",
  "clientId": "ocl_01m4ttwd3veh9apbewxheq5xh9",
  "authMethod": "client_secret_basic",
  "secretPrefix": "or_cs_Exampl",
  "dpopBoundAccessTokens": false,
  "scopes": ["filings:read", "filings:write", "tasks:read", "tasks:write"],
  "createdBy": "usr_01m4ttwd3veh9apbewxheq5xh6",
  "createdAt": "2026-10-25T09:00:00.000Z",
  "updatedAt": "2026-10-26T14:30:00.000Z",
  "pausedAt": null,
  "revokedAt": "2026-10-26T14:30:00.000Z"
}
```

## Errors

| Code                                                                                     | HTTP status | When                                              | What to do                                                                                           |
| ---------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found) | 404         | No agent with this ID exists in the organization. | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
| [`version_conflict`](https://ownrecord.io/docs/reference/errors.md#version_conflict)     | 409         | The agent changed at the same moment; retry.      | Fetch the object again and retry the change.                                                         |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied)   | 403         | You can't manage agents.                          | Ask an organization owner or admin for a role or scope that allows this action.                      |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed), [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`invalid_json`](https://ownrecord.io/docs/reference/errors.md#invalid_json), [`unsupported_media_type`](https://ownrecord.io/docs/reference/errors.md#unsupported_media_type), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`idempotency_key_required`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_required), [`idempotency_key_reused`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_reused), [`idempotency_in_progress`](https://ownrecord.io/docs/reference/errors.md#idempotency_in_progress), [`approval_required`](https://ownrecord.io/docs/reference/errors.md#approval_required), [`approval_rejected`](https://ownrecord.io/docs/reference/errors.md#approval_rejected), [`approval_expired`](https://ownrecord.io/docs/reference/errors.md#approval_expired), [`stale_approval`](https://ownrecord.io/docs/reference/errors.md#stale_approval), [`approval_policy_denied`](https://ownrecord.io/docs/reference/errors.md#approval_policy_denied), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).