Version: v5.7.0

opschain admin trust revoke

packs:agents

opschain admin trust revoke <grant-id> [--server <url>] [--auth-token <token>]

Revokes a trust grant (POST /api/trust/grants/{id}/revoke). A revoke by a human trust administrator applies immediately: the compiled trust snapshot recompiles on the spot, so the next request the grant would have covered is already refused (or falls to a remaining, less permissive grant). The row is kept as a revoked audit artifact, visible in opschain admin trust list.

(An agent proposing a revoke through its own API lane instead stages a pending revoke proposal that leaves the grant active until a human applies it with opschain admin trust approve or clears it with reject; an agent may never propose revoking the grant its own authority rides on.)

<grant-id> comes from opschain admin trust list.

Flags

Flag	Meaning
`--server <url>`	Server base URL. Default: the active context, then `OPSCHAIN_SERVER`.
`--auth-token <token>`	Admin bearer token override. Default: your `opschain login` session, then `$OPSCHAIN_ADMIN_TOKEN`, then the token stored by `opschain admin login` for that server.

Output

Always a machine document (JSON unless -o yaml):

{
  "id": "<grant-id>",
  "status": "revoked"
}

Exit codes

Code	Meaning
0	The grant was revoked.
1	The server refused or failed the request (unknown grant, rejected admin token).
2	Usage — wrong arguments, or no server / admin token resolvable.

Named errors

no active trust grant with that id — 404, exit 1.
a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>' — exit 2.
this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login' — exit 2.
the server rejected the credential — run 'opschain login' again, or check the admin token — exit 1.

Flags​

Output​

Exit codes​

Named errors​

See also​

Flags

Output

Exit codes

Named errors

See also