---
title: "revoke_tztrack_keys"
description: "Generated reference for the management action revoke_tztrack_keys: its description, access metadata, payload contract, and registration status."
slug: /reference/actions/revoke-tztrack-keys
order: 63
visibility: public
redirects_from: []
---

# revoke\_tztrack\_keys

Generated automatically from the [published contract sources](/reference/about#contract-sources).

A script calls this action over HTTPS at `POST https://turnzero.ai/api/v1/actions/revoke_tztrack_keys`, with a bearer credential and the action's payload as the JSON body.

**Build metadata:** Registered in this build. Registration describes the default dispatcher in this build. It does not guarantee that a caller has the required credential or grant, that a tool is listed for that connection, or that the required service is configured.

## Contract description

Revoke every `tztrack` signing key, for a suspected key disclosure\. Super\-admin \(platform operator\) only\. The `tztrack` service refuses each token those keys signed at its first use once its cached key set is a minute old, while the plane responds\. The next `tztrack` token is signed under a fresh key\. In the same act every unrevoked `tztrack` token is revoked at the keys' instant, and the revocation list carries one `all` row\. You get back the revoked key identifiers\.

## Access and action metadata

```json
{
  "name": "revoke_tztrack_keys",
  "resource": "account",
  "tier": "reversible",
  "grant": "super_admin",
  "summary": "Super-admin: revoke every `tztrack` signing key, for a suspected key disclosure; the `tztrack` service refuses each token those keys signed within about a minute while the plane responds. The next `tztrack` token is signed under a fresh key; every unrevoked `tztrack` token is revoked at the same instant, and the revocation list carries one `all` row.",
  "annotations": {
    "readOnlyHint": false,
    "destructiveHint": true,
    "openWorldHint": false
  }
}
```

## MCP catalog entry

```json
{
  "name": "revoke_tztrack_keys",
  "title": "Revoke tztrack signing keys",
  "tier": "reversible",
  "scenario": "API-L0-12",
  "summary": "Revoke every `tztrack` signing key, for a suspected key disclosure. Super-admin (platform operator) only. The `tztrack` service refuses each token those keys signed at its first use once its cached key set is a minute old, while the plane responds. The next `tztrack` token is signed under a fresh key. In the same act every unrevoked `tztrack` token is revoked at the keys' instant, and the revocation list carries one `all` row. You get back the revoked key identifiers.",
  "owners": [
    "MAPI-09",
    "API-L0-12"
  ]
}
```

## request

| JSON pointer | Description and constraints |
|---|---|
| "" \(root\) | Type: object<br>Additional properties: false |

## response

| JSON pointer | Description and constraints |
|---|---|
| "" \(root\) | Type: object<br>Required fields: \["contract\_version","revoked","detail"\]<br>Additional properties: false |
| /<wbr>properties/<wbr>contract\_version | Required value: 1 |
| /<wbr>properties/<wbr>revoked | The key identifiers your call stamped revoked; empty where the `tztrack` key set held no unrevoked key\.<br><br>Type: array |
| /<wbr>properties/<wbr>revoked/<wbr>items | Type: string |
| /<wbr>properties/<wbr>detail | Type: string |

## Complete payload contract

```json
{
  "request": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  },
  "response": {
    "type": "object",
    "required": [
      "contract_version",
      "revoked",
      "detail"
    ],
    "properties": {
      "contract_version": {
        "const": 1
      },
      "revoked": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "The key identifiers your call stamped revoked; empty where the `tztrack` key set held no unrevoked key."
      },
      "detail": {
        "type": "string"
      }
    },
    "additionalProperties": false
  }
}
```

## Shared contracts

- [Refusals](/reference/refusals): every refusal, by surface, with its cause and its remedy
- [schemas/wire\_error\.schema\.json](/reference/sources/schemas/wire-error-schema)
- [schemas/wire\_errors\.json](/reference/sources/schemas/wire-errors)
- [schemas/action\_payloads\.json](/reference/sources/schemas/action-payloads) (includes shared shapes)
- [management\_api\_contract\.md](/reference/sources/management-api-contract)