Revoke an access revocation
Marks a (pending) access revocation as revoked, recording the caller as the provisioner. When there is no current access left to revoke, the revocation is closed as rejected instead — the returned status reflects the outcome.
Closing revocations provisioned outside AccessOwl
This endpoint is the API equivalent of Mark as removed. It marks a pending access revocation as revoked and records the caller as the provisioner — the programmatic equivalent of an admin marking the deprovisioning as done. For an application with no provisioning integration it only closes the record in AccessOwl and never touches the application itself, which is exactly the case where access was removed elsewhere. For an application with a provisioning integration, AccessOwl starts deprovisioning as soon as the revocation is created, so there is no manual task to close and this endpoint is not what triggers the integration. This is the revocation-side counterpart to granting an access request.200
response; read the status field to see the actual outcome (revoked or rejected).422 if the revocation was already revoked or rejected, 404
for an unknown id, 400 for a malformed id, and 403 if the token lacks write
permission.
provisioning_type on the returned revocation is surfaced as automatic for operations
AccessOwl runs itself. The other value, application_admin, marks a manual admin task.Authorizations
Bearer token authentication. Pass your AccessOwl API token in the Authorization header as Bearer <token>.
Headers
Optional key (1–255 chars) for safely retrying a request. Reusing the same key for the same request returns 409 Conflict and is not processed again — this confirms the request was already received. Keys are retained for 14 days.
1 - 255Path Parameters
Access revocation ID
Response
Access revocation revoked
An access revocation
Application ID
Access revocation ID
Revocation reason
Current status of the revocation
processing_access, rejected, revoked User ID of the grantee
Creation timestamp
Permission IDs being revoked
Provisioning type
application_admin, automatic User ID of the requestor
Resource ID (null for app-wide revocations)
The provisioner's rejection reason when the revocation was rejected; null otherwise

