Skip to main content

Retire a CertOps agent

POST 
/api/v1/workspaces/:id/certops/agents/:agentId/retire

Retires an agent so its credential stops authenticating (agent protocol routes return 410). Retiring an already-retired agent is idempotent. If the agent holds actively leased jobs the request is blocked with 409 unless force is true, in which case an attributable reason is required. A forced retire fences the agent's in-flight work immediately rather than leaving it to the lease reaper: jobs still at "claimed" are cancelled with error_code CERTOPS_AGENT_FORCE_RETIRED, while jobs that had reached "running" become orphaned_unknown_effect and are flagged needs_operator_reconciliation, because their real-world effect is unknown. Both id lists are returned in the response and recorded on the CERTOPS_AGENT_RETIRED audit event.

Request​

Responses​

Agent retired (or already retired)