Skip to content

Edit, suspend, reactivate or remove an actor

Change a cryptographic actor's details, stop it temporarily, let it work again, take a role away from it, or revoke it for good.

Who can do it

A tenant administrator or a tenant key manager, and a platform super admin working in a tenant on a private-cloud or on-premise deployment. The console offers Revoke Actor only to a person who holds the permission to delete actors, and each other control only to a person who holds its permission: updating, suspending or reactivating actors, or unassigning roles. None of these controls is offered in a SIMPLE tenant.

Before you start

  • Revoking an actor is terminal. It is refused while active credentials, capability grants or cryptographic exchanges still reference the actor, so revoke those first.
  • A Default Actor cannot be revoked on its own. It is disabled when its application is deleted.
  • Suspending is reversible: a suspended actor keeps its credentials, roles and grants, but cannot authenticate or run operations until it is reactivated.
  • Revoking and suspending need a reason, which is recorded in the audit trail.

Steps

Open Cryptographic Actors from the tenant's navigation and select the actor. Then:

To edit its details:

  1. On Info, select Edit. Edit is not offered on a disabled actor.
  2. Change the display name, description, type, purpose or validity window. Only the fields you change are saved; the name, the application and the status are not changed here. Each date is a UTC day: leave it as it is to keep it, or empty it to remove that limit.
  3. Select Save changes.

To suspend it, while it is active:

  1. On Info, select Suspend.
  2. Enter Why is this actor being suspended?.
  3. Select Suspend actor.

To reactivate it, while it is suspended:

  1. On Info, select Reactivate.
  2. Select Reactivate actor.

To take a role away:

  1. Go to Roles and select the remove control on the role's row. It is offered only for a role the actor holds by direct assignment, and not on a disabled actor.
  2. Select Remove role. A role that a capability grant also confers stays while the grant confers it.

To revoke it:

  1. On Info, select Revoke Actor.
  2. Type the actor's name exactly as shown, and enter the Reason.
  3. Select Revoke.

What you see when it worked

A revoked actor leaves the list, and the console confirms that the actor was deleted. An edit is confirmed with Actor "" updated; a changed validity date takes effect at that day's 00:00 UTC. A role taken away stops applying at the actor's next token: a token already issued keeps the role's permissions until it expires, so suspend the actor to stop it at once.

A suspended actor reads SUSPENDED, and reads ACTIVE again once reactivated.

If it fails

What you see Cause What to do
"Cryptographic Actor cannot be deleted while it still has dependents: … Revoke the dependents first." Active credentials, capability grants or cryptographic exchanges still reference the actor Revoke them, then revoke the actor
Revoke Actor is not offered The actor is its application's Default Actor Delete the application if the actor is no longer needed
A suspend or reactivate is refused as not permitted by the state The actor is already in that state, or it is disabled, which is final Check the actor's status
A change is refused as a concurrent change Another request changed the actor after it was read; nothing was written Read the actor again and retry. See Concurrent Modification
The actor was not changed, The actor was not suspended, The actor was not reactivated or The role was not removed, with the server's detail The server refused the change; the step stays open Act on the detail shown and retry
Valid Until must be strictly after Valid From. The window the edit leaves would end at or before it starts Correct one of the two dates

Without the console

Surface How
API PATCH /api/v3/admin/tenants/{tenantId}/actors/{actorId} (operation updateActor): changes the display name, description, type, purpose and validity window. Only the fields you send change. A validity bound (validFrom or validUntil) you omit keeps its value, one sent as null is cleared, and one sent as an instant is set; the resulting validUntil must be strictly after validFrom
API PATCH /api/v3/admin/tenants/{tenantId}/actors/{actorId}/suspend with a body carrying the reason (operation suspendActor)
API PATCH /api/v3/admin/tenants/{tenantId}/actors/{actorId}/reactivate (operation reactivateActor)
API DELETE /api/v3/admin/tenants/{tenantId}/actors/{actorId}/roles/{roleName} (operation unassignActorRole)
API POST /api/v3/admin/tenants/{tenantId}/actors/{actorId}/revoke with a body carrying the reason (operation revokeActor)