users_passkeys_revoke

Tool

users_passkeys_revoke

REVOKE ONE passkey — the support path for a lost or stolen device.

REVOKE ONE passkey — the support path for a lost or stolen device. It takes effect IMMEDIATELY and permanently: that credential can never sign in again, and the user re-registers from a device they still hold. It is REFUSED (`status: 'failed'`, code `passkey_last_way_in`) when this credential is the account's only remaining way in — no other identity and no verified identifier — because removing it would strand the account forever; add another way in first. It cannot CREATE a passkey: there is no admin-side registration in this toolkit at all, since a credential an operator could enroll is one they could keep. Every revoke is audited (`passkey.deleted`) with the `reason` you pass, so do the identity proofing FIRST and write down what it was.

Behavior

HTTP: DELETE /users/users/:userId/passkeys/:passkeyId

Arguments

Name	Type	Required	Description
reason	string	•	Why this credential is being revoked, and under which ticket. Recorded verbatim in the audit row — this is the whole point of the tool being audited.
userId	string	•	The end user whose passkey is being revoked.
passkeyId	string	•	Which credential to revoke — the `id` from `users_passkeys_list`.

Response

Field	Type	Always	Description
error	object	•	Present when the revoke was refused — today, only because it was the last way in.
status	string	•	`deleted` when the credential is gone, `failed` when the revoke was refused.

Try it

REVOKE ONE passkey — the support path for a lost or stolen device.

When to use

Example

Ask your agent something like this:

REVOKE ONE passkey — the support path for a lost or stolen device.

The agent will invoke users_passkeys_revoke with these arguments:

{
  "reason": "<reason>",
  "userId": "<userId>",
  "passkeyId": "<passkeyId>"
}