Revoke a key or lock a person

A lost device, a key sent in an email, someone leaving the company: revoking a key or locking a person takes effect with the next request, without a restart.

To revoke a single key, use the person's Schlüssel (Keys) tab. To shut off all of a person's access at once, use Person sperren … (Lock person …). Either way, any active second-factor session ends as well.

Revoke a key

1. Open Personen und Schlüssel (People and keys), expand the person's row, and go to the Schlüssel tab.
2. Find the key by its label, its last four characters, or the Zuletzt benutzt (UTC) (Last used (UTC)) and Von (From) columns, and select it.
3. Choose Schlüssel (Keys) > Schlüssel sperren … (Revoke key …) and confirm the prompt, which names the key.

Result: Zustand (State) shows “gesperrt” (revoked), and Gesperrt am (Revoked on) shows when. The next request made with the key gets 401 “gesperrt”.

Lock a person (someone leaves, or a lost device holds several keys)

1. Open Personen und Schlüssel and select the person.
2. Choose Person sperren … and confirm.

Result: The person's account is disabled, which applies to every sign-in right away. All of their keys are permanently revoked, and all of their sessions are ended. If someone enables the account again by mistake later, none of the old keys will work. Their rules stay in place.

Disable the account temporarily (for example, during a long absence): In the person's form, under Zugang (Access), clear the Konto aktiv (Account enabled) check box. Keys and sessions are kept; select the check box again to enable the account, and everything works as before.

• You can't undo a revocation. If the person needs access again, issue them a new key. Only disabling an account can be reversed.
• Deleting works only without traces. The service won't delete a person who has left behind a key, a session, a sign-in, or a change of their own, even if all of it is revoked or expired; that way every log entry still points to a person. Person löschen … (Delete person …) then names the person with the service's reason and offers to lock them instead. Only a person who was created but never used can be deleted.
• Windows accounts and SQL logins are locked where they're managed (Active Directory or SQL Server). Alternatively, remove their assignment under Zuordnungen (Assignments).
• Don't revoke your own last key. If the last administrator locks themselves out, the only way back is a command on the server; see Regain access when administration is locked out (data service documentation).
• Who did it? The audit records every access with the person and the key's ID; see Read the log and sessions.

• Create a person and issue a key
• Issue a presentation key and replace a lost key
• Reference: HTTP: sign-in (reference), section “Personal keys” (data service documentation)