---
title: "Revoke certificate"
source_url: https://dev.digicert.com/certcentral-apis/services-api/certificates/revoke-certificate.html
api_method: PUT
api_endpoint: "/services/v2/certificate/{{certificate_identifier}}/revoke"
api_url: "https://www.digicert.com/services/v2/certificate/{{certificate_identifier}}/revoke"
---

**PUT** `https://www.digicert.com/services/v2/certificate/{{certificate_identifier}}/revoke`

Use this endpoint to submit a request to revoke a single certificate on an order. In the endpoint path, replace [certificate_identifier](https://dev.digicert.com/md/certcentral-apis/services-api/certificates/revoke-certificate.md#certificate_identifier) with the certificate ID or serial number of the certificate to revoke.

To submit a request to **revoke the entire order**, use the [Revoke order certificates](https://dev.digicert.com/md/certcentral-apis/services-api/orders/revoke-order-certificates.md) endpoint.


> **Warning**
>
> **Revoking a certificate is permanent.** For most implementations, revoking a code signing or document signing certificate invalidates past signatures and timestamps on code or documents signed by the certificate.


> **Info**
>
> Certificates with a pending reissue order cannot be revoked. To revoke a certificate with a pending reissue, either cancel the reissue request or revoke the certificate after the reissue is complete.


## Skip the approval step

After submitting the request, an [administrator must approve it](https://dev.digicert.com/md/certcentral-apis/services-api/requests/update-request-status.md) before DigiCert can revoke the certificate.

To skip the approval step and submit the request directly to DigiCert for revocation, include **`"skip_approval": true`** in the body of your request. To skip the approval step, the API key **must have admin privileges**. See [Authentication](https://dev.digicert.com/md/certcentral-apis/authentication.md).

## What happens if I revoke a certificate on an order with only a single certificate?

When you revoke a certificate on an order with only a single certificate:

- The order is still active.
- You can still reissue a certificate on that order.
  If you do not plan to reissue a certificate for the order, use the [Revoke order certificates](https://dev.digicert.com/md/certcentral-apis/services-api/orders/revoke-order-certificates.md) endpoint to submit a request to revoke the order.
- No refund is provided for a revoked certificate on an order.

To change this behavior such that revoking the only certificate on the order **also** revokes the entire order, follow these steps:

1. Sign in to your <a href="https://www.digicert.com/account/login.php" target="_blank" rel="noopener noreferrer">CertCentral account</a>.
2. In the left menu, go to **Settings** **>** **Preferences**.
3. On the Preferences page, expand **Advanced settings**.
4. Under **Certificate Revocations (API Only**), select **Revoke order when all certificates are revoked.**
   This setting only applies to the **Revoke certificate** endpoint in the Services API. To revert to the default behavior, select **Revoke individual certificates**.
5. Scroll to the bottom of the page and click **Save Settings**.

## Example requests and responses

**Skip approval step (cURL)**

```bash
curl --request PUT 'https://www.digicert.com/services/v2/certificate/{{certificate_identifier}}/revoke' \
--header 'Content-Type: application/json' \
--header 'X-DC-DEVKEY: {{api_key}}' \
--data-raw '{
  "skip_approval": true
}'
```

**Create revocation request (cURL)**

```bash
curl --request PUT 'https://www.digicert.com/services/v2/certificate/{{certificate_identifier}}/revoke' \
--header 'Content-Type: application/json' \
--header 'X-DC-DEVKEY: {{api_key}}' \
--data-raw '{
  "comments": "I no longer need this certificate."
}'
```

**Include revocation reason (cURL)**

```bash
curl --request PUT 'https://www.digicert.com/services/v2/certificate/{{certificate_identifier}}/revoke' \
--header 'Content-Type: application/json' \
--header 'X-DC-DEVKEY: {{api_key}}' \
--data-raw '{
  "revocation_reason": "superseded",
  "skip_approval": true
}'
```


**204 No Content (Skip approval step)**

```json
// empty
```

**201 Created (Create revocation request)**

```json
{
  "id": 1,
  "date": "2016-02-10T17:06:15+00:00",
  "type": "revoke",
  "status": "pending",
  "requester": {
    "id": 242140,
    "first_name": "Jack",
    "last_name": "White",
    "email": "j.white@fakeaddy.com"
  },
  "comments": "Revoked via API!"
}
```


## Path parameters

<table>
<thead>
<tr>
<th>Name</th>
<th>Req/Opt</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>certificate_identifier</td>
<td>required</td>
<td>Value that identifies the certificate to revoke. Accepts the certificate ID or serial number.</td>
</tr>
</tbody>
</table>

## Request parameters

<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Req/Opt</th>
<th>Type</th>
<th>Description</th>
</tr>
<tr>
<th>revocation_reason</th>
<th>optional</th>
<th>string</th>
<th>Reason you want to revoke the certificate.
Only used in requests to revoke TLS/SSL certificates. Ignored in revocation requests for other certificate types.
Allowed values:
unspecified (default): None of the other reasons apply.
keyCompromise: The private key associated with the certificate has been lost, stolen, or otherwise compromised.
affiliationChanged: The organization name or any other organizational information in the certificate has changed.
superseded: The certificate has been replaced by another certificate.
cessationOfOperation: The domain is no longer active or managed by your organization, or you no longer use the certificate.</th>
</tr>
</thead>
<tbody>
<tr>
<td>comment</td>
<td>optional</td>
<td>string</td>
<td>Message to associate with the revocation request. Use this field to add a comment to the request for the request approver.<br><strong>Note:</strong> DigiCert only stores the <code>comment</code> value on revocation requests. If <code>skip_approval</code> is true and the requestor has admin privileges, DigiCert revokes the certificate without creating a request, and we do not store the <code>comment</code> value.</td>
</tr>
<tr>
<td>skip_approval</td>
<td>optional</td>
<td>bool</td>
<td>If true, the revoke request skips the approval step and is immediately submitted to DigiCert for revocation. Otherwise, false (default).<br>Note: For skip approvals to work, the API key must have admin privileges.</td>
</tr>
</tbody>
</table>

## Response parameters


> **Info**
>
> If you skip the approval step, the API returns a status of 204 (No Content) instead of these fields.


<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>id</td>
<td>int</td>
<td>Request ID.</td>
</tr>
<tr>
<td>date</td>
<td>string</td>
<td>Timestamp of when the revoke request was submitted.<br>Format: UTC timezone and ISO 8601 date</td>
</tr>
<tr>
<td>type</td>
<td>string</td>
<td>Request type.<br>Possible values:
 revoke</td>
</tr>
<tr>
<td>status</td>
<td>string</td>
<td>Status of the revoke request.<br>Possible values: submitted, pending, approved, rejected</td>
</tr>
<tr>
<td>requester</td>
<td>object</td>
<td>Details about the user that placed the request. See Structures – User details object.</td>
</tr>
<tr>
<td>.. id</td>
<td>int</td>
<td>User ID.</td>
</tr>
<tr>
<td>.. first_name</td>
<td>string</td>
<td>First name of user.</td>
</tr>
<tr>
<td>.. last_name</td>
<td>string</td>
<td>Last name of user.</td>
</tr>
<tr>
<td>.. email</td>
<td>string</td>
<td>Email address of user.</td>
</tr>
<tr>
<td>comments</td>
<td>string</td>
<td>Message about the revoke request.</td>
</tr>
</tbody>
</table>