Revoke an authoring capability
Creates a revocation record naming the given grant and returns it. The grant row is left exactly as issued. Access is decided by the same two gates as issuance, in the same order, both answering 403: without the api-keys:admin scope the scope check refuses FORBIDDEN first; with it, an API key rather than a verified human session is refused HUMAN_PRINCIPAL_REQUIRED.
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Path Parameters
Body
1 - 512Response
An authoring capability record: a grant, or the revocation that supersedes one.
An authoring capability record: a grant, or the revocation that supersedes one.
grant policy.read, draft.edit, draft.validate, review.submit, review.withdraw_request, review.retrieve, case.preview ^[0-9a-f]{64}$