# Revoke

> The revoke operation on whisper.agents: what it tears down in one call, how a stranger confirms it, and what later calls to that identity return.

*Source: https://www.whisper.security/docs/control-plane/operations/revoke*
*Published: 2026-09-19*
*Last updated: 2026-09-19*

---
`revoke` cuts an identity. It needs `admin:dns`, and it does not come back.

## revoke

```whisper-call
CALL whisper.agents({op: 'revoke', args: {agent: 'checkout-bot'}})
```

### Arguments

| Argument | Contract |
|---|---|
| `agent` | The identity to cut. Accepts an identifier or an address. |

### Returns

| Column | Holds |
|---|---|
| `status` | The outcome of the call. |
| `state` | Where the identity now stands. |

One call takes down the address, the forward and reverse names, the DANE pin and the egress path together. There is no undo: a replacement identity is a fresh `register`, with a new address and a new name.

## Confirming it from outside

The teardown is visible to anyone, with no key and no account.

```bash
dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short
curl -s 'https://rdap.whisper.online/verify-identity?ip=2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478'
```

The reverse lookup returns nothing, the verdict comes back with `is_whisper_agent` false, and the event appears in the signed revocation status list. [Keyless endpoints](/docs/control-plane/keyless) has the status list path, and [Revoke an identity](/docs/identity/revoke) walks the whole sequence as a job.

## Afterwards

Any later call naming that identity comes back `403 AGENT_REVOKED`. Its logs stay readable for as long as the account's retention setting keeps them.

## When you want it back

Revocation is the permanent option. To stop an identity's traffic and be able to restore it, use the network-layer hold in [Firewall and response](/docs/control-plane/operations/contain) instead.

## Errors

| Code | Status | Meaning |
|---|---|---|
| `BAD_ARGS` | 400 | No identity was named. |
| `FORBIDDEN_SCOPE` | 403 | The key does not carry `admin:dns`. |
| `AGENT_REVOKED` | 403 | The identity was already cut. |
| `NOT_FOUND` | 404 | No such identity under this account. |
| `PUBLISH_FAILED` | 503 | The teardown did not reach DNS. Retry after the interval in `retry_after`. |