# Revoke a credential invitation.

Revokes a pending invitation so it can no longer be redeemed.
The mutation is single-shot, not idempotent. Repeating it after the invitation leaves `pending` returns `failed_precondition`.

Endpoint: POST /b2b/v1/credential-invitations/{invitationId}/revoke
Version: 1.0.0
Security: BearerAuth

## Path parameters:

  - `invitationId` (string, required)
    Credential invitation ID.

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Invitation resources are isolated per environment.

## Response 200 fields (application/json):

  - `invitation_id` (string, required)
    Credential invitation ID.

  - `environment` (string, required)
    Environment selected by `X-Environment` when the invitation was created.
    Enum: "beta", "production"

  - `credential_definition_id` (string, required)
    Credential definition used for the eventual offer.

  - `credential_definition_name` (string, required)
    Credential definition name captured when the invitation was created.

  - `email` (string, required)
    Normalized recipient email required for public redemption.

  - `code_last4` (string, required)
    Last four normalized code characters for support and delivery confirmation. This is not a redeemable code.

  - `status` (string, required)
    Current invitation lifecycle state.
    Enum: "pending", "redeemed", "expired", "revoked"

  - `reference_id` (string)
    Optional correlation identifier from your system; echoed on the resource.

  - `offer_validity_seconds` (integer)
    Configured lifetime of the offer created after redemption, when supplied at creation.

  - `redeemed_offer_id` (string)
    Offer created by a successful redemption. Present only after redemption.

  - `expires_at` (string, required)
    Invitation-code expiry timestamp in RFC 3339 UTC.

  - `redeemed_at` (string)
    Successful redemption timestamp in RFC 3339 UTC.

  - `revoked_at` (string)
    Revocation timestamp in RFC 3339 UTC.

  - `created_at` (string, required)
    Creation timestamp in RFC 3339 UTC.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 404 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.