Skip to content

Retire an application

Delete an application that is no longer in service, and everything it contains with it. The deletion is terminal: there is no restore.

Who can do it

A tenant administrator or a tenant key manager, and a platform super admin working in a tenant on a private-cloud or on-premise deployment. The console offers Delete Application only to a person who holds the permission to delete applications.

Before you start

  • Review what the application holds. Nothing it contains blocks the deletion, and the deletion reaches all of it:
    • its internal use cases and capability grants are revoked, its exchange contexts are closed and its cryptographic exchanges are revoked;
    • every one of its cryptographic actors is disabled, including the Default Actor, so nothing can authenticate as them any more;
    • keys used only through its actors are archived, with their material retained and never destroyed. A key still used by an actor outside this application keeps its current state.
  • Have a reason ready. It is required and is recorded in the audit trail.

Steps

  1. Open Applications, and select the application to open its detail.
  2. Select Delete Application.
  3. Type the application's name exactly as shown, including capitalization.
  4. Enter the Reason.
  5. Select Revoke.

What you see when it worked

The console confirms that the application was deleted, its actors, credentials, grants and exchanges were taken to terminal states and its keys archived. The application leaves the list, and the counts above the list are read again.

With the permission to read deleted applications, the application and what it contained are listed, read-only, under Retired. Its name is free again: a new application with the same name is a different application that inherits nothing from the deleted one.

If it fails

What you see Cause What to do
"Does not match. Type it exactly as shown, including capitalization." The typed name differs from the application's name Type the name exactly as shown
The deletion is refused as not found The application was already deleted, or is not in this tenant Reload the list
The deletion is refused as a concurrent change Another request changed the application after it was read; nothing was written Open the application again and retry. See Concurrent Modification
The reason is refused It is blank or too long Enter a shorter, non-empty reason

Without the console

Surface How
API POST /api/v3/admin/tenants/{tenantId}/applications/{applicationId}/revoke with a body carrying the reason (operation revokeApplication)
  • Applications: what the screen shows and every decision you make on it.