Revoke CA

Before you Begin

Ensure the following before you revoke a CA:

The CA exists in AppViewX.
You understand that revoking a CA marks it as no longer trusted. Any certificates issued by this CA are also considered untrusted after revocation.
You have resource-level access to the CA.
Refer to Prerequisites in the PKI User Guide.


Endpoint:	`v1/pki/ca/<CAName>/revoke-ca`
Type:	`POST`
Sample URL:	`https://<IP/HostName/TenantName>:<GWPORT>/avxapi/v1/pki/ca/<CAName>/revoke-ca?gwsource=external` To understand the elements of the sample URL, see References.
Headers
Content-Type:	application/json

Table 1. Input Parameters
Name	Description
sessionId `Header`	(Mandatory) Session ID received after login. Type: String Constraint: Required if username and password are not provided.
username `Header`	(Mandatory) AppViewX login username. Type: String Constraint: Required if sessionId is not provided.
password `Header`	(Mandatory) AppViewX login password. Type: String Constraint: Required if sessionId is not provided.
Content-Type `Header`	(Mandatory) Specifies the nature of the data in the payload. Type: String Constraint: Value of the parameter should be 'application/json'
gwkey `Query`	(Mandatory) Tenant Key. This is needed only in case of multi-tenant installations and can be disregarded for other types of installations. Type: String
gwsource `Query`	(Mandatory) Source from which the request is triggered. (E.g. external) Type: String
CAName `Path`	(Mandatory) The name of the CA to revoke. Replace `<CAName>` in the URL with the actual CA name. Type: String
Payload `Body`	Contains all the parameters to be included in the request body for the POST request. Type: Payload


Parameter	Description
`reason`	(Mandatory) The reason for revoking the CA. Type: String. Accepted values (case-insensitive): `Key compromise` The private key has been exposed or stolen. `CA compromise` The CA itself has been compromised. `Affiliation Changed` The organization or owner of the CA has changed. `Superseded` The CA has been replaced by a new CA. `Cessation of operation` The CA is no longer in use. `Privilege withdrawn` The permission to operate this CA has been revoked. `Attribute authority compromise` The authority that issued attributes has been compromised. `Unspecified` No specific reason is provided.
`allCaCerts`	(Optional) Set to `true` to revoke all certificates that this CA has issued. Set to `false` to revoke only the CA certificate itself. Defaults to `false`. Type: Boolean.
`comments`	(Optional) Any additional notes or context about the revocation. Type: String.

The response returns a string of type application/json with the following body parameters:


Parameter	Description
`response`	Indicates the status of the revoke operation. Type: String or Object.
`message`	A description of the result. For example: PKIaaS approval request initiated successfully. Type: String Success or error message. Type: String.
`appStatusCode`	An application-specific status code. This field is empty (`null`) when the request succeeds, and contains an error code when it fails. Type: String
`tags`	Additional information in case of a failure response.


HTTP Status	appStatusCode	Description
`200 OK`	null	The revoke CA action was triggered successfully.
`400 Bad Request`	`INVALID_PAYLOAD`	The CA name in the URL does not match any existing CA, or required fields are missing. Remediation: Verify the CA name and payload, then try again.
`400 Bad Request`	`VALIDATION_ERROR_0004`	The `reason` field contains an invalid value. Remediation: Provide one of the accepted revocation reasons listed above.
`401 Unauthorized`	`AVX_GW_003`	Authentication failed invalid credentials. Remediation: Provide a valid `username` and `password` or a valid `sessionId`.

Sample Request

{
  "reason": "Key compromise",
  "allCaCerts": false,
  "comments": "Private key was exposed during security incident."
}

Sample Response

{
  "response": "Success",
  "message": "PKIaaS approval request initiated successfully.",
  "appStatusCode": null,
  "tags": {},
  "headers": null
}

Understanding the sample URL

IP/HostName/TenantName: Replace with the actual IP address, hostname, or tenant name based on the specific configuration in AppViewX.
- IP: A unique identifier assigned to each device connected to a computer network that uses the Internet Protocol for communication
  The IP address will be included in the endpoint URL for an on-prem deployment.
- HostName: A human-readable label assigned to a device (host) on a network
  The hostname will be included in the endpoint URL for an on-prem deployment.
- TenantName: An identifier label for a tenant given to indicate which tenant's data the API request will access/modify
  The tenant name will be included in the endpoint URL for a SaaS deployment.
GWPORT: AppViewX gateway port
A gateway port refers to a network port through which data is sent and received to communicate with a gateway in an on-prem deployment.
Example: 31443
avxapi: Path parameter value (static) that is part of the endpoint's URL
Endpoint: Endpoint of the API, for example: execute-hook
gwsource: Source or origin of a gateway, for example: external.