Retire a CertOps trust anchor
POST/api/v1/workspaces/:id/certops/trust-anchors/:anchorId/retire
Marks a trust anchor as revoked so future distribute-trust jobs can no longer target it (ADR-0012 decision 20g). Retiring an already-retired anchor is idempotent and returns retiredNow: false. Retiring an anchor does not remove any trust material an agent has already installed; that requires a separate revoke-trust job. Recorded as a CERTOPS_TRUST_ANCHOR_RETIRED audit event.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 409
- 422
- 500
Trust anchor retired (or already retired)
Trust anchor identifier is invalid
Unauthorized
Forbidden
CertOps is disabled or the trust anchor was not found in this workspace
Workspace CertOps is paused
Request rejected because it contained private key material
Internal server error