Revoke an administrator's credentials

curl --request DELETE \
  --url https://api.lightspark.com/grid/2025-10-13/auth/admin-credentials/{adminReference} \
  --header 'Authorization: Basic <encoded-value>'

const options = {method: 'DELETE', headers: {Authorization: 'Basic <encoded-value>'}};

fetch('https://api.lightspark.com/grid/2025-10-13/auth/admin-credentials/{adminReference}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/auth/admin-credentials/{adminReference}")
  .delete(null)
  .addHeader("Authorization", "Basic <encoded-value>")
  .build()

val response = client.newCall(request).execute()

{
  "payloadToSign": "{\"organizationId\":\"org_2m9F...\",\"parameters\":{\"userId\":\"user_2m9F...\"},\"timestampMs\":\"1775681700000\",\"type\":\"ACTIVITY_TYPE_EXAMPLE\"}",
  "requestId": "Request:7c4a8d09-ca37-4e3e-9e0d-8c2b3e9a1f21",
  "expiresAt": "2026-04-08T15:35:00Z",
  "type": "OAUTH"
}

{
  "code": "INVALID_INPUT",
  "reason": "<string>",
  "details": {
    "errors": [
      {
        "field": "identifier",
        "constraint": {
          "format": "email",
          "pattern": "^\\d{5}(-\\d{4})?$",
          "enum": [
            "SSN",
            "ITIN",
            "NON_US_TAX_ID"
          ],
          "minLength": 1,
          "maxLength": 500
        },
        "message": "Value is not one of the allowed enum members."
      }
    ],
    "missingRequirements": [
      "SUPPORTING_PROOF"
    ],
    "refusalReason": "AGENT_POLICY_DENIED",
    "missingFields": [
      "PHONE_NUMBER"
    ]
  }
}

{
  "code": "UNAUTHORIZED",
  "reason": "<string>",
  "details": {}
}

{
  "code": "TRANSACTION_NOT_FOUND",
  "reason": "<string>",
  "details": {}
}

{
  "code": "GRID_SWITCH_ERROR",
  "reason": "<string>",
  "details": {}
}

DELETE

auth

admin-credentials

{adminReference}

Revoke an administrator's credentials

curl --request DELETE \
  --url https://api.lightspark.com/grid/2025-10-13/auth/admin-credentials/{adminReference} \
  --header 'Authorization: Basic <encoded-value>'

const options = {method: 'DELETE', headers: {Authorization: 'Basic <encoded-value>'}};

fetch('https://api.lightspark.com/grid/2025-10-13/auth/admin-credentials/{adminReference}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/auth/admin-credentials/{adminReference}")
  .delete(null)
  .addHeader("Authorization", "Basic <encoded-value>")
  .build()

val response = client.newCall(request).execute()

{
  "payloadToSign": "{\"organizationId\":\"org_2m9F...\",\"parameters\":{\"userId\":\"user_2m9F...\"},\"timestampMs\":\"1775681700000\",\"type\":\"ACTIVITY_TYPE_EXAMPLE\"}",
  "requestId": "Request:7c4a8d09-ca37-4e3e-9e0d-8c2b3e9a1f21",
  "expiresAt": "2026-04-08T15:35:00Z",
  "type": "OAUTH"
}

{
  "code": "INVALID_INPUT",
  "reason": "<string>",
  "details": {
    "errors": [
      {
        "field": "identifier",
        "constraint": {
          "format": "email",
          "pattern": "^\\d{5}(-\\d{4})?$",
          "enum": [
            "SSN",
            "ITIN",
            "NON_US_TAX_ID"
          ],
          "minLength": 1,
          "maxLength": 500
        },
        "message": "Value is not one of the allowed enum members."
      }
    ],
    "missingRequirements": [
      "SUPPORTING_PROOF"
    ],
    "refusalReason": "AGENT_POLICY_DENIED",
    "missingFields": [
      "PHONE_NUMBER"
    ]
  }
}

{
  "code": "UNAUTHORIZED",
  "reason": "<string>",
  "details": {}
}

{
  "code": "TRANSACTION_NOT_FOUND",
  "reason": "<string>",
  "details": {}
}

{
  "code": "GRID_SWITCH_ERROR",
  "reason": "<string>",
  "details": {}
}

Authorizations

Authorization

string

header

required

API token authentication using format <api token id>:<api client secret>

Headers

Grid-Wallet-Signature

string

Full API-key stamp built over the prior payloadToSign with the session API keypair of an existing verified credential on the same internal account. Required on each signed retry.

Request-Id

string

The requestId of the 202 being answered, echoed back exactly on the signed retry. Must be paired with Grid-Wallet-Signature.

Path Parameters

adminReference

string

required

The administrator reference the credentials were added with.

Query Parameters

accountId

string

required

The internal account whose administrator is revoked.

Response

A signature is needed: stamp payloadToSign with the session key of an existing verified credential on the account and retry with Grid-Wallet-Signature and Request-Id.

202 response returned from Embedded Wallet Auth endpoints that require a signed retry — POST /auth/credentials (adding an additional credential), DELETE /auth/credentials/{id} (revoking a credential), DELETE /auth/sessions/{id} (revoking a session), and the EMAIL_OTP / SMS_OTP branch of POST /auth/credentials/{id}/verify (the secure OTP login flow, where the client submits an encryptedOtpBundle and receives a login signing message as payloadToSign to stamp for session issuance). Carries the signing fields from SignedRequestChallenge plus the type of the authentication credential involved (being added, revoked, that issued the session being revoked, or being authenticated). The client already knows the target resource id from the request path / body it just sent, so nothing beyond type is echoed in the response.

The keypair used to compute the stamp depends on the operation. For credential / session management retries, sign with the session API keypair of an existing verified credential on the same internal account. For OTP verify retries, sign with the ephemeral Target Encryption Key (TEK) the client generated for this login — its public key is the one carried inside the encryptedOtpBundle and bound into the verificationToken, and it becomes the client's session API key on successful completion.

payloadToSign

string

required

Payload for the retry authorization stamp. Build an API-key stamp over the exact UTF-8 bytes of this string, without parsing, re-serializing, or trimming it. Use the keypair required by the endpoint: the client's TEK keypair for OTP verification, or an active session API keypair for other signed wallet actions. Send the full base64url-encoded stamp in Grid-Wallet-Signature on the retry that completes the original request.

Example:

"{\"organizationId\":\"org_2m9F...\",\"parameters\":{\"userId\":\"user_2m9F...\"},\"timestampMs\":\"1775681700000\",\"type\":\"ACTIVITY_TYPE_EXAMPLE\"}"

requestId

string

required

Grid-issued Request:<uuid> identifier for this pending request. Echo this value exactly in the Request-Id header on the signed retry so the server can correlate the retry with the issued challenge.

Example:

"Request:7c4a8d09-ca37-4e3e-9e0d-8c2b3e9a1f21"

expiresAt

string<date-time>

required

Timestamp after which this challenge is no longer valid. The signed retry must be submitted before this time.

Example:

"2026-04-08T15:35:00Z"

type

enum<string>

required

Credential type relevant to this challenge: the credential type being added (POST /auth/credentials), revoked (DELETE /auth/credentials/{id}), or authenticated (EMAIL_OTP / SMS_OTP branch of POST /auth/credentials/{id}/verify). For session revocation, this is the type of credential that issued the session (DELETE /auth/sessions/{id}).

Available options:

OAUTH,

EMAIL_OTP,

SMS_OTP,

PASSKEY

Using the API

API documentation

Revoke an administrator's credentials

Authorizations

Headers

Path Parameters

Query Parameters

Response