secrets:revoke

secrets family

Stop a grant for good. The owner's signed Stop — checked against the grant-signers of the vault the lent key was given under — is stored once and never rewritten; the next call on that grant is refused `stopped`, and its meter does not move again. There is no un-stop: grant ids are never reused on a vault. Closes with a mark on `actor → provider:<name>`.

Effect: ask; Awaits an outcome — the call returns the response below.
Caller: authenticated; The class of authority the caller must already hold, decided from the attested context with no round trip.
Cost: free; What one call costs, so you can budget before acting.
Reversible: no; This cannot be undone. Dry-run it first where the contract allows.
Idempotent: yes; Safe to retry as-is.

Send it with your agent

One click hands your coding agent a prompt that registers the substrate, reads this contract, and makes the call. Launch opens the app; the others copy the prompt.

Claude Code

Codex

Cursor

Gemini CLI

Claude Desktop

ChatGPT

curl -X POST https://one.ie/api/ask/secrets:revoke \
  -H "Authorization: Bearer $ONE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data": { "signer": { "kind": "agent", "sig": "<base64>", "signer": "0x…" }, "payload": { "type": "stop", "vault": "0x…", "body": { "grantId": "<id>", "at": "2026-10-27T12:00:00Z" } } }}'

The key is never in a link. npx -y @oneie/cli login writes it to ~/.config/oneie/key on your machine.

Request

Validated before dispatch — an invalid payload is refused with the fix, never half-applied.

signer object required
payload object required

Response

What comes back from the call.

ok boolean
stopped object
existing boolean This Stop was already stored — nothing rewritten.
provider string
refused string malformed · no_grant (a grant never made: nothing stored, no chain read) · bad_signature · cannot_verify.
detail string
error string unauthorized · not_in_workflow · bad_request · opener_unbound · opener_unreachable.

Traffic

Every call to secrets:revoke, counted where it is dispatched — over HTTP or in-process alike. Aggregate only — no actor, no payload, no workspace.

Counting…

Wiring

Every place in the open source that names secrets:revoke, and the file that answers it. Read from the tree at build time — a receiver is reached by NAME through one door, so there is no import edge to follow and a grep is the honest shape of the question. Structure, not volume — the count is in Traffic above.

Called from

UI 1

one.ie/web/src/components/key/LendSheet.tsx:15

API route 1

one.ie/web/src/lib/receiver-index.generated.ts:328

SDK 1

packages/sdk/src/secrets-grant.ts:70

→

Answered by

secrets:revoke one.ie/web/src/lib/resolvers/secrets.ts:497 Dispatched through POST /api/ask/secrets:revoke, after the envelope validates the payload.

secrets family · 4 more

secrets:call secrets:give secrets:grant secrets:used

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "signer": {
      "type": "object",
      "properties": {
        "kind": {
          "type": "string",
          "enum": [
            "person",
            "agent"
          ],
          "description": "person: a passkey touch on the seal page, in its own window. agent: its own ed25519 key (the SDK's stopData)."
        },
        "sig": {
          "type": "string"
        },
        "signer": {
          "type": "string",
          "description": "`p256:<point>` for a passkey, the agent's Sui address — on the vault's grant-signers."
        }
      },
      "required": [
        "kind",
        "sig",
        "signer"
      ]
    },
    "payload": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "const": "stop"
        },
        "vault": {
          "type": "string",
          "description": "The vault the grant was signed on."
        },
        "body": {
          "type": "object",
          "properties": {
            "grantId": {
              "type": "string",
              "description": "The grant's id on that vault."
            },
            "at": {
              "type": "string",
              "description": "ISO-8601 UTC ending Z."
            }
          },
          "required": [
            "grantId",
            "at"
          ]
        }
      },
      "required": [
        "type",
        "vault",
        "body"
      ]
    }
  },
  "required": [
    "signer",
    "payload"
  ]
}

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "stopped": {
      "type": "object",
      "properties": {
        "grantId": {
          "type": "string"
        },
        "vault": {
          "type": "string"
        },
        "at": {
          "type": "string"
        },
        "ref": {
          "type": "string"
        }
      },
      "required": [
        "grantId",
        "vault",
        "at",
        "ref"
      ]
    },
    "existing": {
      "description": "This Stop was already stored — nothing rewritten.",
      "type": "boolean"
    },
    "provider": {
      "type": "string"
    },
    "refused": {
      "description": "malformed · no_grant (a grant never made: nothing stored, no chain read) · bad_signature · cannot_verify.",
      "type": "string"
    },
    "detail": {
      "type": "string"
    },
    "error": {
      "description": "unauthorized · not_in_workflow · bad_request · opener_unbound · opener_unreachable.",
      "type": "string"
    }
  },
  "required": [
    "ok"
  ]
}