Revoke an authoring capability
Creates a revocation record naming the given grant and returns it. The grant row is left exactly as issued. Access is decided by the same two gates as issuance, in the same order, both answering 403: without the api-keys:admin scope the scope check refuses FORBIDDEN first; with it, an API key rather than a verified human session is refused HUMAN_PRINCIPAL_REQUIRED.
A grant the server carried to a successor draft (it has succeeds_capability_id) is part of a chain that starts at the grant a human issued. Revoking ANY grant of a chain ends that grant and every grant carried from it, so a grant that was itself carried on may be revoked. 409 AUTHORING_CAPABILITY_ALREADY_REVOKED when the named grant already has a revocation or exhaustion of its own; 409 AUTHORING_CAPABILITY_CHAIN_ENDED when it has none but a grant it was carried from does, with details naming that record: ending_record_id, ending_record_type and ended_grant_id. 500 AUTHORING_CAPABILITY_READBACK_FAILED means the revocation WAS committed and only the read of it afterwards came back empty or failed (details.committed is true). A 404 on this route means nothing was written.
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Path Parameters
Body
1 - 512Response
An authoring capability record: a grant, or the revocation that supersedes one.
An authoring capability record: a grant, or the revocation that supersedes one.
grant policy.read, draft.edit, draft.validate, review.submit, review.withdraw_request, review.retrieve, case.preview ^[0-9a-f]{64}$What the agent DECLARES about itself, recorded on the capability at issuance. It is inside the capability digest preimage and therefore covered by the grantor signature, so it cannot be edited after issuance without breaking the record. That is the whole of the property: it does not establish that the named model exists, that it is the model that authenticated, or that it produced anything. Never read by any admission decision.
Present only on a grant the server minted when a draft supersession carried an authoring capability to the successor draft: the grant this one continues. Inside the capability digest preimage.