Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Revoke an OpenStack API credential
Deletes the application credential on the cloud at once (it stops authenticating; tokens already issued
from it live until they expire, at most the Keystone token lifetime) and marks the record revoked
(revokeReason: user). Allowed for the credential's own member, tokens: manage for a service-account
credential, and iam: manage for any credential in the project.
Errors: 401; 403; 404; 409 not active.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
credentialId*stringIdentifier of the credential to revoke.
Idempotency-Key?stringOptional; recommended for safe retries. When sent, the same key+body within 24h replays the original result and the same key with a different body is 409 CONFLICT; keys are unique per tenant. When an API token or service-account (bearer) caller omits it, the request is applied once with no replay protection (a retry may apply it again). A console session gets one from the edge.
uuidRevoked; the updated record is returned.
application/json- response
An OpenStack application credential minted by the platform (the secret is never included).
id*stringname*stringprojectId*stringThe portal project (scope) id.
owner*Who the credential authenticates as (a member, or a service account).
profile*OpenStackCredentialProfilefull = Keystone member + load-balancer_member; readonly = reader + load-balancer_observer.
Never more than the owner's projected roles on the project.
"full""readonly"roles*array<string>The Keystone roles the credential carries.
status*OpenStackCredentialStatusLifecycle of an OpenStack API credential.
"active""revoked""expired"applicationCredentialId?|The Keystone application credential id (not a secret).
expiresAt*stringdate-timecreatedAt*stringdate-timecreatedBy*stringlastUsedAt?|date-timerevokedAt?|date-timerevokeReason?|nullrotatedFromId?string|nullreplacedById?string|nulldeleteAfter?|End of a rotation overlap window (the old credential is deleted then).
date-timecurl -X DELETE "https://example.com/scopes/string/iam/openstack-credentials/string"{ "id": "string", "name": "string", "projectId": "string", "owner": { "kind": "user", "id": "string" }, "profile": "full", "roles": [ "string" ], "status": "active", "applicationCredentialId": "string", "expiresAt": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z", "createdBy": "string", "lastUsedAt": "2019-08-24T14:15:22Z", "revokedAt": "2019-08-24T14:15:22Z", "revokeReason": "user", "rotatedFromId": "string", "replacedById": "string", "deleteAfter": "2019-08-24T14:15:22Z"}