Revoke an Identity

revoke is the permanent cut. One call withdraws the address, the forward and reverse records, the DANE pin and the egress credential together, and the identity does not come back. Use it when an agent is compromised or retired.

If you want a hold you can lift, use firewall default-deny instead: it flips the per-identity default from allow to deny at the network edge and leaves the identity intact. That operation is documented in Firewall and Response.

1. Revoke

Name the identity by label or by address. Anything containing a colon is read as an address.

curl -s https://graph.whisper.online/api/query \
  -H "X-API-Key: <your key>" \
  -H "content-type: application/json" \
  --data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'revoke', args: {agent: 'shipping-bot'}})"}
JSON

The reply carries the new state:

{
  "columns": ["op", "ok", "status", "result", "error", "retry_after", "elapsed_ms"],
  "rows": [
    {
      "op": "revoke",
      "ok": true,
      "status": 200,
      "error": null,
      "result": {
        "columns": ["status", "state"],
        "rows": [["revoked", "revoked"]]
      }
    }
  ]
}

2. Wait out the record lifetime

The records are withdrawn immediately at the authoritative servers. Resolvers that already cached an answer keep it until the record's own lifetime expires, so give the checks below one cache cycle before you read them as evidence.

3. Prove the address is gone

The reverse lookup that used to name the identity now returns nothing.

dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short

4. Prove the verdict flipped

The keyless endpoint answers 200 with is_whisper_agent set to false, which is the same answer any address that was never an identity gets.

curl -s "https://rdap.whisper.online/verify-identity?ip=2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478" | jq .is_whisper_agent

5. Show it in the signed status list

The revocation is also an entry in the signed status list published alongside the transparency log, which is what turns "we cut it" into something a third party can check for themselves.

curl -s https://whisper.online/checkpoint/status-list

The Transparency Log explains how that list and the checkpoints relate, and Keyless Endpoints is the reference for the endpoints above.

Where the host layer takes over

Revoking acts on Whisper infrastructure, so it holds even when the machine is fully owned. It reaches the network and stops there: a process already running on a compromised host keeps running. When the host carries the sensor, Contain an Endpoint covers the host-layer actions that stop a process or quarantine a file, and The Response Ladder covers how the two layers combine.