Revoke a Principal or Device¶

What this is: cutting off someone's access — or a device's access — immediately and permanently. When you'd do it: someone leaves, a device is lost or stolen, or something looks compromised. How long it takes: under a minute. The system does the rest automatically.

Who can do this: an Admin. These screens only show up if your own login has the Admin role. A normal Operator login won't see the Revoke button — if it's missing, ask an admin to do this.

A quick word before you start: revocation is permanent. There is no undo button. If you revoke someone by mistake, the only way to restore their access is to onboard them again from scratch (see Onboard an Operator). Take a moment to make sure you have the right person or device before you click.

Lost, stolen, or captured? The group key rotates for you. Revocation stops the device from authenticating — its tokens are refused everywhere. On its own that would not re-key content: a captured device keeps a still-valid copy of the group key and could keep reading content sealed under the current epoch until the key is rotated. So the system rotates the group key automatically on a loss:

Revoking a device or node always rotates (it holds the key).

Revoking a person rotates only if you tick "Device lost / captured" on the revoke dialog (below) — a routine leaver does not re-key the whole fleet, but a captured handset does.

A revoked device is left out of the new key, so it is cut off from newly-sealed content within moments — no separate trip to Rotate Keys needed. You can still rotate by hand there if you want belt-and-braces.

The shape of it¶

flowchart LR
    A["You open their<br/>page"] --> B["Click Revoke<br/>and confirm"]
    B --> C["All servers stop<br/>trusting them"]

One screen, one button, one confirmation. After that, every server in the network will refuse their tokens automatically — you don't need to touch anything else.

Before you start¶

You're signed in to the Directory site as an admin.
You know whether you're revoking a person (under Principals) or a device (under Devices).
You're confident you have the right record. Remember: this cannot be undone.

Steps¶

Revoking a person¶

Open the people list. In the top menu, click Principals.
Find their record. Click their name to open their page.
Revoke them. In the Principal Info card, click Revoke Principal (the red button, bottom right of the card). If this person's phone or tablet was lost, stolen, or captured, first tick the "Device lost / captured — rotate group key" box next to the button; that tells the system to re-key content as well as cut off their login. Leave it unticked for a routine leaver.
Confirm. A dialog appears:

Revoke this principal? Their tokens will be rejected by all servers within the revocation poll window.

Click OK to continue.

Revoking a device¶

Open the device list. In the top menu, click Devices.
Find the device. Click its callsign to open its page.
Revoke it. In the Device Info card, click Revoke Device (the red button, bottom right of the card).
Confirm. A dialog appears:

Revoke this device? Tokens for this device will be rejected by all servers within the revocation poll window.

Click OK to continue.

Note: if the Revoke button is greyed out, the system is protecting you from locking yourself out — you cannot revoke the last active principal or device in the system.

How to know it worked¶

Their page now shows a red revoked badge next to their name.
The Revoke button is gone — the page is now read-only.
Within the revocation poll window, every server will start refusing their tokens. No further action needed on your part.

If something goes wrong¶

You revoked the wrong person. There is no undo. To restore their access, onboard them again as a new principal — see Onboard an Operator. They will get a fresh profile and will need to re-register their security key.
The Revoke button isn't there. Either the person/device is already revoked (check for the red badge), or you're viewing the page as a non-admin. Ask another admin to check.
The button is greyed out. The system won't let you revoke the very last active principal or device — it prevents an accidental full lockout. Add another active principal or device first, then revoke this one.
You're not sure if it's worked yet. The change is instant in the Directory. Servers pick it up automatically within the poll window — you don't need to restart anything or notify servers manually.