# Revoke an Identity

> Revoke a Whisper agent identity with one control-plane call, and prove the withdrawal through DNS, the keyless verdict and the signed status list.

*Source: https://www.whisper.security/docs/identity/revoke*

---
`revoke` is the permanent cut. One call withdraws the address, the forward and reverse records, the DANE pin and the egress credential together, and the identity does not come back. Use it when an agent is compromised or retired.

If you want a hold you can lift, use `firewall default-deny` instead: it flips the per-identity default from allow to deny at the network edge and leaves the identity intact. That operation is documented in [Firewall and Response](/docs/control-plane/operations/contain).

## 1. Revoke

Name the identity by label or by address. Anything containing a colon is read as an address.

```bash
curl -s https://graph.whisper.online/api/query \
  -H "X-API-Key: <your key>" \
  -H "content-type: application/json" \
  --data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'revoke', args: {agent: 'shipping-bot'}})"}
JSON
```

The reply carries the new state:

```json
{
  "columns": ["op", "ok", "status", "result", "error", "retry_after", "elapsed_ms"],
  "rows": [
    {
      "op": "revoke",
      "ok": true,
      "status": 200,
      "error": null,
      "result": {
        "columns": ["status", "state"],
        "rows": [["revoked", "revoked"]]
      }
    }
  ]
}
```

## 2. Wait out the record lifetime

The records are withdrawn immediately at the authoritative servers. Resolvers that already cached an answer keep it until the record's own lifetime expires, so give the checks below one cache cycle before you read them as evidence.

## 3. Prove the address is gone

The reverse lookup that used to name the identity now returns nothing.

```bash
dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short
```

## 4. Prove the verdict flipped

The keyless endpoint answers `200` with `is_whisper_agent` set to `false`, which is the same answer any address that was never an identity gets.

```bash
curl -s "https://rdap.whisper.online/verify-identity?ip=2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478" | jq .is_whisper_agent
```

## 5. Show it in the signed status list

The revocation is also an entry in the signed status list published alongside the transparency log, which is what turns "we cut it" into something a third party can check for themselves.

```bash
curl -s https://whisper.online/checkpoint/status-list
```

[The Transparency Log](/docs/identity/transparency) explains how that list and the checkpoints relate, and [Keyless Endpoints](/docs/control-plane/keyless) is the reference for the endpoints above.

## Where the host layer takes over

Revoking acts on Whisper infrastructure, so it holds even when the machine is fully owned. It reaches the network and stops there: a process already running on a compromised host keeps running. When the host carries the sensor, [Contain an Endpoint](/docs/endpoint/operate/contain) covers the host-layer actions that stop a process or quarantine a file, and [The Response Ladder](/docs/endpoint/operate/response) covers how the two layers combine.