Revocation API

Revoke one subscriber's certificate from your backend.

DELETE /api/inventory/v1/partners/{partner_id}/users/{subscriber_id}/
X-Helium-P-API-Key: pk_live_...

Request

Path param	Type	Description
`partner_id`	UUID	Your partner ID. The same one the SDK uses.
`subscriber_id`	string	The opaque ID you originally passed to `install()`.

No request body.

Response

Status	Meaning
`204`	Subscriber revoked. The certificate can no longer be used to connect.
`400`	Malformed `partner_id` or `subscriber_id`.
`401`	Bad or missing API key.
`403`	Key is valid but lacks write scope on this partner's subscribers.
`404`	Subscriber doesn't exist, or was already revoked.
`5xx`	Transient. Retry with backoff.

What revocation does

The subscriber record is deleted and the certificate is revoked at the CA.
Devices already connected aren't kicked off. The certificate is rejected on the next connection attempt.
The revocation propagates to Helium's RADIUS infrastructure on its next refresh cycle.

Examples

curl -X DELETE \
-H "X-Helium-P-API-Key: $HELIUM_WIFI_API_KEY" \
https://api.prod.hib.nova.xyz/api/inventory/v1/partners/$PARTNER_ID/users/sub_42/

Idempotency

Calling DELETE on an already-revoked subscriber returns 404. Treat 404 as success when your goal is "ensure this subscriber is revoked". The post-state is correct either way.

Audit trail

Every revocation is logged at the gateway with:

Your API key ID, never the secret.
The partner ID and subscriber ID.
A request_id.

TODO: confirm with @Oleksandr whether and how Helium exposes audit logs to partners. Today they're internal. If you need a paper trail, log on your side at the time of the API call.

Bulk revocation