Skip to main content

Revoke an Accreditation

Revocation marks an accreditation as permanently invalid. Any verifier that queries the TIR and finds issuerType = REVOKED will reject credentials issued by that entity.

Revocation is permanent

Once an accreditation is revoked, there is no mechanism to reactivate it. If the entity needs to continue operating, a new accreditation with a different attributeId must be published.

Who can revoke​

Revocation must be executed by:

  • The entity that published the accreditation (the parent accreditor).
  • An entity with higher hierarchy in the same trust chain.

The accreditation subject cannot revoke its own accreditation.

How it works technically​

Revocation does not delete the attribute from the TIR. It overwrites the issuerType field of the existing attribute with the value REVOKED (4). The attribute remains accessible at the TIR URL but indicates the revoked state.

The process uses the same JSON-RPC method setAttributeMetadata used for publishing, but with issuerType: "REVOKED":

{
  "jsonrpc": "2.0",
  "method": "setAttributeMetadata",
  "params": [
    {
      "from": "0x<OPERATOR_ETHEREUM_ADDRESS>",
      "did": "did:isbe:uc:<SUBJECT_DID>",
      "revisionId": "0x<ATTRIBUTE_ID>",
      "issuerType": "REVOKED",
      "taoDid": "did:isbe:uc:<ACCREDITING_TAO_DID>",
      "attributeIdTao": "0x<TAO_ATTRIBUTE_ID>"
    }
  ],
  "id": 1
}

The complete flow follows the same three steps as publication: setAttributeMetadata → sign → sendSignedTransaction. Only setAttributeMetadata is needed, not setAttributeData, because the data (JWT) does not change — only the metadata changes.

Request revocation​

Currently the revocation process is executed by an ISBE operator. To request revocation of an accreditation, contact the ISBE team providing:

  • The DID of the subject whose accreditation must be revoked.
  • The attributeId (64 hex chars) of the accreditation to revoke.
  • The reason for revocation.
  • The environment (production, pre-production, or development).

Impact on the trust chain​

Revocation has a cascade effect: if a TAO's accreditation is revoked, all TIs accredited by that TAO become invalid. The verifier ascends the chain to the RTAO and, if it finds any revoked link, rejects the full validation.

This also applies to credentials already issued by a TI whose accreditation has been revoked: previously issued credentials are invalidated from the moment of revocation.

Verify the state after revocation​

Check the accreditation status by querying the TIR REST endpoint:

curl "https://tir.portal.redisbe.com/trusted-issuers-registry/v1/issuers/did:isbe:uc:<DID>/attributes/<ATTRIBUTE_ID>"

The response will include "issuerType": "REVOKED" (or the numeric value 4) when the revocation has been processed.

Revocation latency

The revocation transaction is not instantaneous. After sending the transaction to the blockchain, a brief period may elapse before it is included in a block. Verify the transaction receipt (eth_getTransactionReceipt) before considering the revocation complete.