Revoke

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'revoke' } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'complete',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'revoke' } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'complete',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

Carrier: POST /v1/exchange (encrypted binary). Permission: Owner only. Advance authority epoch and revoke all old grants. The same command is available over WebSocket.

Fields below describe the SDK request before encryption and the decoded reply. The HTTP body is encrypted binary application/octet-stream, not JSON. Use a verified SDK client; the interactive playground is disabled.

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'revoke' } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'complete',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

Request fields

The client supplies the configured domain, account, policy, signer and verified session binding, and signs the canonical envelope.

Uint8Array (32 bytes)

required

Nonzero private request ID. Retain it for an exact retry; use a distinct ID for a different intent.

bigint (u64)

required

Current account authority epoch.

bigint (u64)

required

Authentication expiry in milliseconds, within the verified session and deployment limits.

"revoke"

required

Command discriminator.

Response fields

The example uses illustrative quote atoms and configured IDs, not live venue data. A receipt records operation progress; acceptance is not execution or payment.

"receipt"

required

Response discriminator.

Uint8Array (32 bytes)

required

Durable operation ID. For an operation lookup, this is the target ID, not the query ID.

Uint8Array (32 bytes)

required

Commitment to the immutable economic intent.

number (u32)

required

Governed policy version.

Outcome

required

rejected, accepted, dispatched, acknowledged, partial, complete or unknown. See lifecycle.

bigint (i64)

required

Actual attributed signed lots, not requested quantity.

bigint (i128)

required

Qualified net payment to the beneficiary, in quote atoms.

bigint (i128)

required

Actual customer-paid payout rail fees; not ordinary trading fees.

bigint (i128)

required

Declared fee cap: absolute requested lots × fee-per-lot for orders, or extra rail-fee cap for payouts. Not the amount charged.

boolean

required

Whether the operation may have escaped for external execution. False alone is not a final settlement guarantee.

boolean

required

The recorded payout partial-dispatch consent. False for unrelated commands.

Behavior

Durable receipt. Success advances the epoch; old grants and old-epoch signed requests lose authority. Obtain current epoch before further requests. A stale-epoch retry is unauthorized even for a previously accepted ID. Selective revocation is not implemented. Revocation does not cancel escaped native orders or undo payouts; reconcile outstanding operations.

Errors and reconciliation

Typed errors are returned inside the encrypted reply, not as field-specific HTTP status codes. Invalid fields, expired or out-of-scope authority, conflicting intent IDs and unavailable required evidence fail closed. A delivery error or timeout is not a rejection. Reconnect with fresh attestation and reconcile the original operation ID before any economic retry. See lifecycle, limits and availability.

Overview

Commands

Private reads

WebSocket

Request fields

Response fields

Behavior

Errors and reconciliation

​Request fields

​Response fields

​Behavior

​Errors and reconciliation

Request fields

Response fields

Behavior

Errors and reconciliation