revoke_fullmakt

no.apier/mcp · Verify this server

Revoke a fullmakt — withdraw an agent's delegated authority for a Norwegian company and retire the agent principal (broker with request_fullmakt, inspect with check_fullmakt). Given ONLY the agent_principal_id (system_user_id and org_number are read server-side from the write-once binding, so a client cannot redirect the revoke), Apier revokes the bound delegation and flips the principal to terminal `revoked` — never resurrected; create a new principal to act again. LOCAL revocation is authoritative and immediate. Idempotent: an already-revoked principal/delegation is a 200 no-op. `warnings[]` carries NAMED outcome tokens (principal_revoke_failed, delegation_not_found, upstream_revoke_unconfirmed) — read the specific token rather than treating any non-empty array as a local failure. Input: { agent_principal_id (uuid), reason? (audit-only) }. Failure modes: FULLMAKT_PRINCIPAL_NOT_FOUND, SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/fullmakt