Docs / Licences

Revoke

POST/api/workspaces/:id/licenses/:licenseId/revoke

Ends a licence for good: the key will never validate again. Revoked, not deleted, so "what did we give this person" survives it.

Not an API-key endpoint

Unlike Validate and Issue, this route is not reachable with a license.manage API key from outside a browser session. It sits under a workspace's own routes, and is checked against the signed-in session cookie and the licenses.revoke workspace permission, the same as any other action taken from the dashboard. The license.manage scope exists on API keys today but nothing in the public API currently checks for it here.

In practice: revoke a licence from the dashboard's Licences page, or by calling this route from your own backend while it holds a valid session for a member of the workspace.

Request

  • Field
    reason
    Type
    string
    Required
    No
    Notes
    4 to 500 characters if given. Recorded on the licence.

Response

json
{ "ok": true }

A caller without licenses.revoke in the workspace gets the same permission error every other guarded workspace route gives; see Errors.

Example

For a seller's own backend, signed in as a member of the workspace, not for software given to a customer.

javascript
// Signed in as a member of the workspace: this call carries the
// dashboard's session cookie, not an API key.
const res = await fetch(
  `https://bloomcloud.pro/api/workspaces/${workspaceId}/licenses/${licenseId}/revoke`,
  {
    method: 'POST',
    credentials: 'include',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ reason: 'Refunded on request' }),
  },
);

const result = await res.json();
if (!result.ok) {
  throw new Error('Could not revoke the licence');
}