Revocation Endpoint

The core function is the synchronous termination of access rights. Upon receiving a valid revocation request, the endpoint must instantly update the Policy Decision Point (PDP) to deny future authorization checks.

• Real-time enforcement: The associated JSON Web Token (JWT) or API key is marked as invalid in the authorization cache.
• Propagation latency: In distributed systems, the target for cache synchronization should be under 60 seconds.
• State transition: The license moves from an active to a revoked state in the License State Machine, preventing any further data queries.

A revocation endpoint must be idempotent to ensure safe retries in unreliable network conditions. Multiple identical revocation requests must produce the same outcome as a single request without triggering errors or duplicate processing.

• Idempotency Key: Clients pass a unique key in the Idempotency-Key header. The server stores the response for a defined window.
• Safe retries: If a timeout occurs, the client can resend the request without accidentally revoking a different license.
• Consistent state: The endpoint returns 200 OK for both the initial successful revocation and any subsequent retries with the same key.

Revoking a master license must trigger a cascading invalidation of all downstream access artifacts. This prevents orphaned tokens from continuing to grant unauthorized data ingestion.

• Token chaining: All OAuth2 Machine-to-Machine access tokens and refresh tokens issued under the parent license are recursively invalidated.
• Session termination: Any active data streaming sessions established via the license are forcibly disconnected at the Policy Enforcement Point (PEP).
• Quota freeze: The Quota Management system records the final data volume consumed and prevents further usage accrual.

Every revocation event must generate an immutable, verifiable audit record. This provides non-repudiation for both the licensor and licensee, critical for compliance and dispute resolution.

• Signed receipts: The endpoint returns a cryptographically signed revocation receipt containing the license identifier, timestamp, and requesting entity.
• Compliance logging: A structured log entry is written to the AI Audit Logging system, detailing the reason code and authorization context.
• Provenance integration: The revocation event is published to the Provenance API, updating the data lineage record to reflect the termination of access rights.

While access is terminated immediately, the endpoint should trigger a structured notification to the licensee's registered webhook. This prevents operational surprises and supports automated cleanup on the consumer side.

• Webhook dispatch: An HTTP POST containing the revocation details is sent to the consumer's pre-registered endpoint.
• Standardized payload: The notification uses a schema aligned with the Rights Expression Language (REL) to describe the terminated permissions.
• Retry logic: The notification system implements exponential backoff to guarantee eventual delivery, decoupled from the synchronous revocation response.

Advanced endpoints support partial revocation, allowing a licensor to terminate a subset of permissions without invalidating the entire license agreement. This enables precise enforcement of changing terms.

• Scope filtering: The request body specifies which Scoped Access permissions to remove, such as read:corpus:finance while retaining read:corpus:public.
• Token re-issuance: If partial revocation occurs, the system may issue a new, narrower JWT to the consumer automatically.
• Policy update: The Entitlement Service recalculates the effective permissions, ensuring the PDP enforces the reduced scope on the next authorization request.

An authorization mechanism where a cryptographically signed token, such as a JWT, grants temporary, scoped access to a content licensing API. The revocation endpoint directly invalidates these tokens, severing the trust relationship without requiring credential rotation. Revocation checks typically occur at the Policy Enforcement Point (PEP) via introspection or token blacklists.

The architectural component that evaluates authorization requests against defined policies and issues an access decision. When a revocation endpoint is triggered, the PDP must immediately update its state to deny access for the revoked license. Common patterns include:

• Real-time token introspection against the revocation list
• Cached deny-lists with near-zero staleness
• Event-driven cache invalidation on revocation events

A behavioral model defining the lifecycle of a license agreement as a finite set of states and valid transitions. The revocation endpoint triggers a transition from an active or suspended state to a terminal revoked state. This transition is irreversible and must propagate to all downstream enforcement points, including CDN edge nodes and local caching layers.

A reverse proxy acting as the single entry point for all API clients, handling cross-cutting concerns like authentication and rate limiting. The gateway integrates with the revocation endpoint by:

• Validating token status on every request
• Rejecting requests bearing revoked tokens with HTTP 403 Forbidden
• Logging denied access attempts for audit trails This ensures revoked consumers cannot bypass enforcement by targeting backend services directly.

A compact, URL-safe token format used to securely transmit claims between parties. JWTs are inherently self-contained, meaning revocation requires explicit mechanisms such as:

• Token revocation lists (JWT Revocation Lists)
• Short-lived tokens with mandatory refresh cycles
• OAuth 2.0 Token Revocation endpoint integration A revocation endpoint must invalidate the JWT's unique identifier (jti claim) to prevent continued use of a stolen or misused token.