---
title: revoke-a-signing-key
product: vercel
url: /docs/rest-api/kms/revoke-a-signing-key
canonical_url: "https://vercel.com/docs/rest-api/kms/revoke-a-signing-key"
last_updated: 2026-09-08
type: reference
prerequisites:
  []
related:
  - /docs/rest-api
summary: Learn about revoke-a-signing-key on Vercel.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Revoke a signing key

```http
POST /v1/kms/issuers/{issuerId}/keys/{keyId}/revoke
```

Immediately revoke a signing key that is already scheduled for revocation.

## Authentication

**bearerToken**: HTTP bearer

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `issuerId` | string | Yes | The ID of the issuer. |
| `keyId` | string | Yes | The ID of the signing key to revoke immediately. The key must already be scheduled for revocation. |


## Query parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `teamId` | string | No | The Team identifier to perform the request on behalf of. |
| `slug` | string | No | The Team slug to perform the request on behalf of. |


## Example request

### TypeScript

```typescript
const response = await fetch('https://api.vercel.com/v1/kms/issuers/issuerId/keys/keyId/revoke?teamId=string&slug=string', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);
```

### Next.js

```typescript
'use server';

export async function callEndpoint() {
  const response = await fetch('https://api.vercel.com/v1/kms/issuers/issuerId/keys/keyId/revoke?teamId=string&slug=string', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.VERCEL_ACCESS_TOKEN}`,
      'Content-Type': 'application/json',
    },
    next: { revalidate: 3600 }
  });

  if (!response.ok) {
    throw new Error('Request failed');
  }

  return response.json();
}
```

### cURL

```bash
curl -X POST 'https://api.vercel.com/v1/kms/issuers/issuerId/keys/keyId/revoke?teamId=string&slug=string' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json'
```

## Example response

```json
{
  "id": "icfg_1234567890",
  "ownerId": "example_id",
  "name": "Example Name",
  "algorithm": "ES256",
  "origin": "external",
  "managedBy": "string",
  "claimsSchema": "value",
  "createdAt": "string",
  "updatedAt": "string",
  "signingKeys": [
    {
      "keyId": "example_id",
      "importKeyId": "example_id",
      "issuerId": "example_id",
      "algorithm": "string",
      "status": "active",
      "publicKey": {
        "kty": "string",
        "kid": "example_id",
        "alg": "string",
        "use": "string",
        "key_ops": [],
        "x5c": [],
        "x5t#S256": "string"
      },
      "publicKeyFingerprint": "string",
      "publicKeyPem": "string",
      "certificatePem": "string",
      "createdAt": "string",
      "updatedAt": "string",
      "revokeAt": "string",
      "activateAt": "string",
      "activatedAt": "string"
    }
  ],
  "policies": [
    {
      "kind": "project-grant",
      "teamId": "example_id",
      "projectId": "example_id",
      "environments": [],
      "tokenClaims": "value",
      "createdAt": "string",
      "updatedAt": "string"
    }
  ]
}
```

## Responses

### 200: No description

Content-Type: `application/json`

```json
{
  "type": "object",
  "required": [
    "algorithm",
    "createdAt",
    "id",
    "name",
    "origin",
    "ownerId",
    "policies",
    "signingKeys",
    "updatedAt"
  ],
  "properties": {
    "id": {
      "type": "string"
    },
    "ownerId": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "algorithm": {
      "type": "string",
      "enum": [
        "ES256",
        "ES384",
        "ES512",
        "EdDSA",
        "PS256",
        "PS384",
        "PS512",
        "RS256",
        "RS384",
        "RS512"
      ]
    },
    "origin": {
      "type": "string",
      "enum": [
        "external",
        "vercel"
      ]
    },
    "managedBy": {
      "type": "string"
    },
    "claimsSchema": {
      "type": "object",
      "additionalProperties": true
    },
    "createdAt": {
      "type": "string"
    },
    "updatedAt": {
      "type": "string"
    },
    "signingKeys": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "algorithm",
          "createdAt",
          "issuerId",
          "keyId",
          "status",
          "updatedAt"
        ],
        "properties": {
          "keyId": {
            "type": "string",
            "description": "The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints."
          },
          "importKeyId": {
            "type": "string",
            "description": "The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys."
          },
          "issuerId": {
            "type": "string"
          },
          "algorithm": {
            "type": "string"
          },
          "status": {
            "type": "string",
            "enum": [
              "active",
              "pending",
              "revoking"
            ]
          },
          "publicKey": {
            "type": "object"
          },
          "publicKeyFingerprint": {
            "type": "string"
          },
          "publicKeyPem": {
            "type": "string",
            "description": "The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it."
          },
          "certificatePem": {
            "type": "string",
            "description": "The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored."
          },
          "createdAt": {
            "type": "string"
          },
          "updatedAt": {
            "type": "string"
          },
          "revokeAt": {
            "type": "string"
          },
          "activateAt": {
            "type": "string"
          },
          "activatedAt": {
            "type": "string",
            "description": "When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field)."
          }
        }
      }
    },
    "policies": {
      "type": "array",
      "items": {
        "oneOf": [
          {
            "type": "object",
            "required": [
              "createdAt",
              "environments",
              "kind",
              "projectId",
              "teamId",
              "updatedAt"
            ]
          },
          {
            "type": "object",
            "required": [
              "clientId",
              "createdAt",
              "kind",
              "updatedAt"
            ]
          }
        ]
      }
    }
  }
}
```

### 400: One of the provided values in the request query is invalid.

### 401: The request is not authorized.

### 403: You do not have permission to access this resource.

### 404: No description

### 409: No description

### 410: No description

---

## Related

- [kms endpoints](/docs/rest-api#kms)

- [REST API overview](/docs/rest-api)

- [OpenAPI spec](https://openapi.vercel.sh/) (machine-readable, all endpoints)

---

[View full sitemap](/docs/sitemap)