Skip to main content
POST
Mark an access revocation as revoked

Closing revocations provisioned outside AccessOwl

This endpoint is the API equivalent of Mark as removed. It marks a pending access revocation as revoked and records the caller as the provisioner — the programmatic equivalent of an admin marking the deprovisioning as done. For an application with no provisioning integration it only closes the record in AccessOwl and never touches the application itself, which is exactly the case where access was removed elsewhere. For an application with a provisioning integration, AccessOwl starts deprovisioning as soon as the revocation is created, so there is no manual task to close and this endpoint is not what triggers the integration. This is the revocation-side counterpart to granting an access request.
If there is no current access left to revoke, the revocation is closed as rejected instead of revoked — there is nothing left to remove. Either way you get a 200 response; read the status field to see the actual outcome (revoked or rejected).
The other responses are 422 if the revocation was already revoked or rejected, 404 for an unknown id, 400 for a malformed id, and 403 if the token lacks write permission.
provisioning_type on the returned revocation is surfaced as automatic for operations AccessOwl runs itself. The other value, application_admin, marks a manual admin task.
To be notified when a revocation is closed, subscribe to the revocation.revoked and revocation.rejected webhook events. They fire when the revocation reaches its final status, whichever outcome it lands on.

Authorizations

Authorization
string
header
required

Bearer token authentication. Pass your AccessOwl API token in the Authorization header as Bearer <token>.

Headers

Idempotency-Key
string

Optional key (1–255 chars) for safely retrying a request. Reusing the same key for the same request returns 409 Conflict and is not processed again — this confirms the request was already received. Keys are retained for 14 days.

Required string length: 1 - 255

Path Parameters

access_revocation_id
string<uuid>
required

Access revocation ID

Response

Access revocation revoked

An access revocation

application_id
string<uuid>
required

Application ID

id
string<uuid>
required

Access revocation ID

reason
string
required

Revocation reason

status
enum<string>
required

Current status of the revocation

Available options:
processing_access,
rejected,
revoked
grantee_user_id
string<uuid>

User ID of the grantee

inserted_at
string<date-time>

Creation timestamp

permission_ids
string<uuid>[] | null

Permission IDs being revoked

provisioning_type
enum<string> | null

Provisioning type

Available options:
application_admin,
automatic
requestor_user_id
string<uuid>

User ID of the requestor

resource_id
string<uuid> | null

Resource ID (null for app-wide revocations)

termination_reason
string | null

The provisioner's rejection reason when the revocation was rejected; null otherwise

Last modified on September 12, 2026