Revoke access
Use this page to cut off a person, a script, a join token, Apelora's own Incus identities or a server.
| What | How |
|---|---|
| A person's or a script's API token | Fabric Console → Administration → Revoke, or DELETE /api/v1/tokens/<id>. Takes effect on the next request; audited (token.revoke). |
| A person's Apelora sign-in (local account or directory) | Identity & Access → Sign-ins & tokens → Sign out, a password reset, or disabling the person. Takes effect on the next request; a terminal or PowerShell session they opened with it closes within 30 s (access-revoked). |
| Membership through an identity provider or directory group | Remove them from the group there; they lose it at their next sign-in. A group's members come only from the source it names (Identity & Access → Groups). |
| An unused cluster join token | Servers → Machines and join tokens → Revoke, or DELETE /api/v1/cluster/join-tokens/<member>. |
| Apelora's Incus identities (deploy or admin certificate) | Rotate them: certificates.md. |
| A server that left the cluster | See member-failure.md (A member that will not return). |
After any revocation, check the audit log for actions by the revoked actor since the time of concern.
For a stolen credential or a misused account, follow a security incident.
This page is a copy of docs/runbooks/access-revocation.md in the repository, which is the source of truth. Suggest a change.