Fac-360
Companies

Revoke an API credential

Immediate, not at expiry: auth.lookup_api_credential re-reads revoked_at on every authenticated request, so the next one fails. Same DEVELOPER floor as minting, deliberately and never higher -- revocation is the emergency action, and a system where creating a credential is easier than killing it has the incentives backwards. Unknown, already revoked, and belonging to another company are one 404.

DELETE
/console/v1/companies/{companyId}/credentials/{credentialId}

Immediate, not at expiry: auth.lookup_api_credential re-reads revoked_at on every authenticated request, so the next one fails. Same DEVELOPER floor as minting, deliberately and never higher -- revocation is the emergency action, and a system where creating a credential is easier than killing it has the incentives backwards. Unknown, already revoked, and belonging to another company are one 404.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

companyId*string
Formatuuid
credentialId*string
Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Authorization: Bearer apf_v2_tu_credencial"
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "companyId": "8bb73d03-06b4-47c7-80c7-59301f770eda",  "credentialId": "f568fec0-10b6-4b94-9daf-e62c50c9bf3e",  "revokedAt": "2019-08-24T14:15:22Z"}

Mint an API credential POST POST

DEVELOPER and above, which is what ADR 0016 point 7 assigns to that role. The credential can issue comprobantes, so this is the privilege escalation the ADR names and does not pretend otherwise about: the mitigation is that it is recorded. The credential row and its ops.audit_events row are written in one transaction by the SAME function the provisioning API calls, and a DEFERRABLE constraint trigger on auth.api_credentials refuses at COMMIT to admit a credential for an organization-owned company without one -- so an unaudited mint is not a policy violation, it is a failed transaction. THE TOKEN IS IN THE 201 AND NOWHERE ELSE. A scope the caller's own role could not exercise is refused with 403 SCOPE_NOT_GRANTABLE rather than silently dropped.

Plan consumption for this company GET GET

A read, and only a read. ADR 0016 point 6 keeps the quota holder on the company and usage.consume_quota is untouched. The period is this company's own plan period, not a window this route picked.