revoke_tztrack_keys #

View this page as Markdown

Generated automatically from the published contract sources.

A script calls this action over HTTPS at POST https://turnzero.ai/api/v1/actions/revoke_tztrack_keys, with a bearer credential and the action's payload as the JSON body.

Build metadata: Registered in this build. Registration describes the default dispatcher in this build. It does not guarantee that a caller has the required credential or grant, that a tool is listed for that connection, or that the required service is configured.

Contract description #

Revoke every tztrack signing key, for a suspected key disclosure. Super-admin (platform operator) only. The tztrack service refuses each token those keys signed at its first use once its cached key set is a minute old, while the plane responds. The next tztrack token is signed under a fresh key. In the same act every unrevoked tztrack token is revoked at the keys' instant, and the revocation list carries one all row. You get back the revoked key identifiers.

Access and action metadata #

{
  "name": "revoke_tztrack_keys",
  "resource": "account",
  "tier": "reversible",
  "grant": "super_admin",
  "summary": "Super-admin: revoke every `tztrack` signing key, for a suspected key disclosure; the `tztrack` service refuses each token those keys signed within about a minute while the plane responds. The next `tztrack` token is signed under a fresh key; every unrevoked `tztrack` token is revoked at the same instant, and the revocation list carries one `all` row.",
  "annotations": {
    "readOnlyHint": false,
    "destructiveHint": true,
    "openWorldHint": false
  }
}

MCP catalog entry #

{
  "name": "revoke_tztrack_keys",
  "title": "Revoke tztrack signing keys",
  "tier": "reversible",
  "scenario": "API-L0-12",
  "summary": "Revoke every `tztrack` signing key, for a suspected key disclosure. Super-admin (platform operator) only. The `tztrack` service refuses each token those keys signed at its first use once its cached key set is a minute old, while the plane responds. The next `tztrack` token is signed under a fresh key. In the same act every unrevoked `tztrack` token is revoked at the keys' instant, and the revocation list carries one `all` row. You get back the revoked key identifiers.",
  "owners": [
    "MAPI-09",
    "API-L0-12"
  ]
}

request #

JSON pointer Description and constraints
"" (root) Type: object
Additional properties: false

response #

JSON pointer Description and constraints
"" (root) Type: object
Required fields: ["contract_version","revoked","detail"]
Additional properties: false
/properties/contract_version Required value: 1
/properties/revoked The key identifiers your call stamped revoked; empty where the tztrack key set held no unrevoked key.

Type: array
/properties/revoked/items Type: string
/properties/detail Type: string

Complete payload contract #

{
  "request": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  },
  "response": {
    "type": "object",
    "required": [
      "contract_version",
      "revoked",
      "detail"
    ],
    "properties": {
      "contract_version": {
        "const": 1
      },
      "revoked": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "The key identifiers your call stamped revoked; empty where the `tztrack` key set held no unrevoked key."
      },
      "detail": {
        "type": "string"
      }
    },
    "additionalProperties": false
  }
}

Shared contracts #