---
title: "Revoke order certificates"
source_url: https://dev.digicert.com/certcentral-apis/services-api/orders/revoke-order-certificates.html
api_method: PUT
api_endpoint: "/services/v2/order/certificate/{{order_id}}/revoke"
api_url: "https://www.digicert.com/services/v2/order/certificate/{{order_id}}/revoke"
---

**PUT** `https://www.digicert.com/services/v2/order/certificate/{{order_id}}/revoke`

Use this endpoint to submit a request to revoke all certificates on an order.

This operation revokes all certificates on an order, including duplicates and reissues. To revoke only a single certificate on an order, use the [Revoke certificate](https://dev.digicert.com/md/certcentral-apis/services-api/certificates/revoke-certificate.md) endpoint.


> **Warning**
>
> **Revoking a certificate is permanent.** For most implementations, revoking a code signing or document signing certificate invalidates past signatures and timestamps on code or documents signed by the certificate.


## Skip the approval step

After submitting the request, an [administrator must approve it](https://dev.digicert.com/md/certcentral-apis/services-api/requests/update-request-status.md) before DigiCert can revoke the certificate.

To skip the approval step and submit the request directly to DigiCert for revocation, include **`"skip_approval": true`** in the body of your request. To skip the approval step, the API key **must have admin privileges**. See [Authentication](https://dev.digicert.com/md/certcentral-apis/authentication.md).

## Example requests and responses

**Skip approval step (cURL)**

```bash
curl --request PUT 'https://www.digicert.com/services/v2/order/certificate/{{order_id}}/revoke' \
--header 'Content-Type: application/json' \
--header 'X-DC-DEVKEY: {{api_key}}' \
--data-raw '{
  "skip_approval": true
}'
```

**Create revocation request (cURL)**

```bash
curl --request PUT 'https://www.digicert.com/services/v2/order/certificate/{{order_id}}/revoke' \
--header 'Content-Type: application/json' \
--header 'X-DC-DEVKEY: {{api_key}}' \
--data-raw '{
  "comments": "I no longer need this certificate."
}'
```

**Include revocation reason (cURL)**

```bash
curl --request PUT 'https://www.digicert.com/services/v2/order/certificate/{{order_id}}/revoke' \
--header 'Content-Type: application/json' \
--header 'X-DC-DEVKEY: {{api_key}}' \
--data-raw '{
  "revocation_reason": "superseded",
  "skip_approval": true
}'
```


**204 No Content (Skip approval step)**

```json
// empty
```

**201 Created (Create revocation request)**

```json
{
  "id": 1,
  "date": "2016-02-10T17:06:15+00:00",
  "type": "revoke",
  "status": "pending",
  "requester": {
    "id": 242140,
    "first_name": "Jack",
    "last_name": "White",
    "email": "j.white@fakeaddy.com"
  },
  "comments": "Revoked via API!"
}
```


## Request parameters

<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Req/Opt</th>
<th>Type</th>
<th>Description</th>
</tr>
<tr>
<th>revocation_reason</th>
<th>optional</th>
<th>string</th>
<th>Reason you want to revoke the certificate.
Only used in requests to revoke TLS/SSL certificates. Ignored in revocation requests for other certificate types.
Allowed values:
unspecified (default): None of the other reasons apply.
keyCompromise: The private key associated with the certificate has been lost, stolen, or otherwise compromised.
affiliationChanged: The organization name or any other organizational information in the certificate has changed.
superseded: The certificate has been replaced by another certificate.
cessationOfOperation: The domain is no longer active or managed by your organization, or you no longer use the certificate.</th>
</tr>
</thead>
<tbody>
<tr>
<td>comment</td>
<td>optional</td>
<td>string</td>
<td>Message to associate with the revocation request. Use this field to add a comment to the request for the request approver.<br><strong>Note:</strong> DigiCert only stores the <code>comment</code> value on revocation requests. If <code>skip_approval</code> is true and the requestor has admin privileges, DigiCert revokes the certificate without creating a request, and we do not store the <code>comment</code> value.</td>
</tr>
<tr>
<td>skip_approval</td>
<td>optional</td>
<td>bool</td>
<td>If true, the revoke request skips the approval step and is immediately submitted to DigiCert for revocation. Otherwise, false (default).<br>Note: For skip approvals to work, the API key must have admin privileges.</td>
</tr>
</tbody>
</table>

## Response parameters


> **Info**
>
> If you skip the approval step, the API returns a status of 204 (No Content) instead of these fields.


<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>id</td>
<td>int</td>
<td>Request ID.</td>
</tr>
<tr>
<td>date</td>
<td>string</td>
<td>Timestamp of when the revoke request was submitted.<br>Format: UTC timezone and ISO 8601 date</td>
</tr>
<tr>
<td>type</td>
<td>string</td>
<td>Request type.<br>Possible values:
 revoke</td>
</tr>
<tr>
<td>status</td>
<td>string</td>
<td>Status of the revoke request.<br>Possible values: submitted, pending, approved, rejected</td>
</tr>
<tr>
<td>requester</td>
<td>object</td>
<td>Details about the user that placed the request. See Structures – User details object.</td>
</tr>
<tr>
<td>.. id</td>
<td>int</td>
<td>User ID.</td>
</tr>
<tr>
<td>.. first_name</td>
<td>string</td>
<td>First name of user.</td>
</tr>
<tr>
<td>.. last_name</td>
<td>string</td>
<td>Last name of user.</td>
</tr>
<tr>
<td>.. email</td>
<td>string</td>
<td>Email address of user.</td>
</tr>
<tr>
<td>comments</td>
<td>string</td>
<td>Message about the revoke request.</td>
</tr>
</tbody>
</table>