Revoke an authorization · Ownrecord docs

Ends an authorization at once, for example when the person left or the power of attorney was withdrawn: submissions can't reference it any more. It stays in the record (with the reason) for the audit chain of what was submitted under it. Revoking twice is refused (authorization_status_invalid).

Compliance tier (spec §41.4): an agent's call needs approval under the default policy.

At a glance

REST: POST /api/v1/authorizations/{id}/revoke
MCP tool: authorizations_revoke
Operation ID: authorizations.revoke
Scope: Legal entity
Permission: tasks:write
Risk tier: compliance
Dry run: Supported (send Ownrecord-Dry-Run: true)
Idempotency: Idempotency-Key required
Modes: Test and live
Authentication: API key with the tasks:write scope
Since: M10

Request

Path parameters

Field	Type	Description
`id`	`atz_…` ID

Body

A JSON object (Content-Type: application/json):

Field	Type	Required	Description
`reason`	string	Yes

Response

200 OK with a JSON object:

Field	Type	Description
`id`	`atz_…` ID
`object`	`"authorization"`
`entityId`	`ent_…` ID
`livemode`	boolean
`regimeIds`	array of string
`holder`	object
`holder.type`	one of `person`, `firm`, `app`
`holder.name`	string
`holder.contact`	string or null
`holder.appInstallationId`	`ains_…` ID or null
`kind`	one of `employee_eid`, `power_of_attorney`, `tax_representative`, `fiscal_representative`, `api_oauth`
`documentFileId`	`file_…` ID or null
`validFrom`	date-time
`validTo`	date-time or null
`portals`	array of string
`accessNotes`	object or null
`status`	one of `active`, `expired`, `revoked`, `not_yet_valid`
`revokedAt`	date-time or null
`revocationReason`	string or null
`createdAt`	date-time
`updatedAt`	date-time
`version`	integer (at least 1)

Examples

Ana left the company

HTTP

POST /api/v1/authorizations/atz_01m4ttwd3veh9apbewxheq5xa3/revoke
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "reason": "Ana left the company on 31 October."
}

Response (200):

JSON

{
  "id": "atz_01m4ttwd3veh9apbewxheq5xa3",
  "object": "authorization",
  "entityId": "ent_01m4ttwd3veh9apbewxheq5xh4",
  "livemode": true,
  "regimeIds": ["EU_OSS_UNION"],
  "holder": {
    "type": "person",
    "name": "Ana Horvat",
    "contact": "ana.horvat@example.com",
    "appInstallationId": null
  },
  "kind": "employee_eid",
  "documentFileId": null,
  "validFrom": "2026-01-01T00:00:00.000Z",
  "validTo": "2027-12-31T23:00:00.000Z",
  "portals": ["Croatian Tax Administration OSS portal (ePorezna)"],
  "accessNotes": {
    "method": "eid",
    "renewalDueAt": "2027-11-30T23:00:00.000Z",
    "notes": "Ana signs in with her personal eID card."
  },
  "status": "revoked",
  "revokedAt": "2026-11-08T09:15:00.000Z",
  "revocationReason": "Ana left the company on 31 October.",
  "createdAt": "2026-01-05T10:00:00.000Z",
  "updatedAt": "2026-11-08T09:15:00.000Z",
  "version": 2
}

Errors

Code	HTTP status	When	What to do
`validation_failed`	400	No reason.	Fix the fields listed in `details.issues` and send the request again.
`resource_not_found`	404	No authorization with this ID for this entity in this mode.	Check the ID and that your credentials are scoped to the right organization, entity, brand and mode.
`authorization_status_invalid`	409	It is already revoked.	A revoked authorization doesn't change. Record a new one with `authorizations.create`.
`version_conflict`	409	It changed at the same moment.	Fetch the object again and retry the change.
`scope_required`	400	The request names no legal entity.	Call the operation with credentials or a target at its level: an organization, a legal entity, a brand or the platform (`details.required_scope`).
`permission_denied`	403	You can't manage this entity's tasks and authorizations.	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: api_version_unsupported, invalid_json, unsupported_media_type, authentication_required, api_key_invalid, idempotency_key_required, idempotency_key_reused, idempotency_in_progress, approval_required, approval_rejected, approval_expired, stale_approval, approval_policy_denied, rate_limited, internal_error.

At a glance#

Request#

Path parameters#

Body#

Response#

Examples#

Ana left the company#

Errors#