revoke_tzmesh_keys #

View this page as Markdown

Generated automatically from the published contract sources.

A script calls this action over HTTPS at POST https://turnzero.ai/api/v1/actions/revoke_tzmesh_keys, with a bearer credential and the action's payload as the JSON body.

Build metadata: Registered in this build. Registration describes the default dispatcher in this build. It does not guarantee that a caller has the required credential or grant, that a tool is listed for that connection, or that the required service is configured.

Contract description #

Revoke every tzmesh signing key, for a suspected key disclosure. Super-admin (platform operator) only. The tzmesh service refuses each token those keys signed at its first use once its cached key set is a minute old, while the plane responds. The next tzmesh token is signed under a fresh key. In the same act every unrevoked tzmesh token is revoked at the keys' instant, and the revocation list carries one all row. Returns the revoked key identifiers.

Access and action metadata #

{
  "name": "revoke_tzmesh_keys",
  "resource": "account",
  "tier": "reversible",
  "grant": "super_admin",
  "summary": "Super-admin: revoke every `tzmesh` signing key, for a suspected key disclosure; the `tzmesh` service refuses each token those keys signed within about a minute while the plane responds. The next `tzmesh` token is signed under a fresh key; every unrevoked `tzmesh` token is revoked at the same instant, and the revocation list carries one `all` row.",
  "annotations": {
    "readOnlyHint": false,
    "destructiveHint": true,
    "openWorldHint": false
  }
}

MCP catalog entry #

{
  "name": "revoke_tzmesh_keys",
  "title": "Revoke tzmesh signing keys",
  "tier": "reversible",
  "scenario": "API-L0-12",
  "summary": "Revoke every `tzmesh` signing key, for a suspected key disclosure. Super-admin (platform operator) only. The `tzmesh` service refuses each token those keys signed at its first use once its cached key set is a minute old, while the plane responds. The next `tzmesh` token is signed under a fresh key. In the same act every unrevoked `tzmesh` token is revoked at the keys' instant, and the revocation list carries one `all` row. Returns the revoked key identifiers.",
  "owners": [
    "MAPI-09",
    "API-L0-12"
  ]
}

request #

JSON pointer Description and constraints
"" (root) Type: object
Additional properties: false

response #

JSON pointer Description and constraints
"" (root) Type: object
Required fields: ["contract_version","revoked","detail"]
Additional properties: false
/properties/contract_version Required value: 1
/properties/revoked The key identifiers your call stamped revoked; empty where the tzmesh key set held no unrevoked key.

Type: array
/properties/revoked/items Type: string
/properties/detail Type: string

Complete payload contract #

{
  "request": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  },
  "response": {
    "type": "object",
    "required": [
      "contract_version",
      "revoked",
      "detail"
    ],
    "properties": {
      "contract_version": {
        "const": 1
      },
      "revoked": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "The key identifiers your call stamped revoked; empty where the `tzmesh` key set held no unrevoked key."
      },
      "detail": {
        "type": "string"
      }
    },
    "additionalProperties": false
  }
}

Shared contracts #