POST | Deactivate credential

Description

Deactivate a credential in PAM Core. A deactivated credential remains stored and auditable, but rejects checkout, rotation, and update requests.

This action is the only way to set a credential as inactive. The active field is derived and cannot be sent in a create or update request. This endpoint is part of the A2A API v2 surface for credentials. The v1 equivalent is documented in DELETE | Disable credential.

Attention

API v2 has no endpoint that permanently deletes a credential. Deactivation is the only mechanism available for taking a credential out of active use. A credential deactivated through this endpoint keeps its identification code, its history, and its audit trail.

Prerequisites

An application authorization granted by the administrator in A2A, with its PAM resource permission set to Read and write. For more information, access How to manage authorizations in A2A.
A valid OAuth 2.0 access token. For more information, access How to authenticate an application in A2A.
The credential must be active. Deactivating a credential that is already inactive returns 409.

Request

POST /api/v2/pam/credentials/{id}/deactivate

Path parameters

Field	Type	Required	Description
`id`	integer	Yes	Unique identification code of the credential. Note: this value is assigned by Segura®.

The request has no body.

Example request

POST {{url}}/api/v2/pam/credentials/12/deactivate

Response

HTTP/1.1 204 No Content

The response has no body. To confirm the new state, retrieve the credential with GET | List a credential by [id] and check the credential.active field.

What changes after deactivation

Operation	Behavior on an inactive credential
Read requests	Succeed. The credential returns `200` with `credential.active` set to `false`.
Write requests and actions	Rejected with `409` and the code `api.resource.inactive`. This covers full and partial updates and password rotation.
Activation	Succeeds. Use POST \| Activate credential to return the credential to active use.

Errors

HTTP code	Message	Possible cause	Solution
`401`	`api.auth.token.invalid`	The access token is missing or has expired.	Request a new access token.
`403`	`api.permission.denied`	The authorization does not have permission to update credentials.	Ask the administrator to set the PAM resource permission to Read and write in A2A, then generate a new token.
`404`	`api.resource.not_found`	The credential does not exist, or it is outside the scope of the authorization.	Check the identification code sent in the path.
`409`	`api.resource.conflict.already_inactive`	The credential is already inactive.	No action is needed, the credential is already in the requested state.
`429`	`rate_limit_exceeded`	The request rate limit was exceeded.	Reduce the request rate and try again.
`500`	`api.internal.error`	Internal server error.	Contact the Segura® support team.

Example error response

409 the credential is already inactive:

{
    "error": {
        "code": "api.resource.conflict.already_inactive",
        "message": "Credential is already inactive."
    }
}

Info

This action is not idempotent. Repeating it on a credential that is already inactive returns 409 rather than 204. Retrieve the credential's current state before retrying a request whose outcome you are unsure of.