Revoking a machine
Revoking cuts a single machine off. Its credential is deleted, its connection drops within about a second, and reconnection attempts are refused.
How to revoke
Two places in the console, both doing the same thing:
- Machines → the machine → Summary tab → Security card → Revoke
- Machines → the machine's card → toolbar → Revoke
You are asked to confirm.
What survives
The machine's record stays. Its labels, its history, and its availability data are all intact — it is simply marked as no longer enrolled.
This is deliberate. A decommissioned machine you revoked last month should still be something you can look at, and deleting the record would take the history with it.
When to revoke
- The machine was lost or stolen. Revoking stops it reporting anything further.
- You are decommissioning it. Revoke first, then uninstall the agent, so nothing reports from it in between.
- You think its credential file was copied. Revoke, then re-enroll it to issue a fresh secret — see Re-enrolling.
- You do not recognise it. Revoke first and investigate afterwards.
Bringing it back
Run the agent again with an API key set. It re-enrolls into the same record with a new secret. Nothing is lost.
If the machine still has its old credential file, delete it first — the agent only re-enrolls when it finds no credential.
Revoking a machine versus revoking a key
They do different things and are not substitutes:
| Revoking a machine | Revoking an API key | |
|---|---|---|
| Stops that machine reporting | Yes, in about a second | No |
| Stops new machines enrolling | No | Yes |
| Affects other machines | No | No |
| Reversible | Yes, re-enroll it | No, create a new key |
If you want to stop everything, you have to revoke each machine. There is no single switch that disconnects a whole fleet.