---
title: "POST | Deactivate credential"
slug: "api-v2-post-deactivate-credential"
updated: 2026-11-03T14:47:51Z
published: 2026-11-03T14:47:51Z
canonical: "docs.senhasegura.io/api-v2-post-deactivate-credential"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# POST | Deactivate credential

## Description

Deactivate a credential in PAM Core. A deactivated credential remains stored and auditable, but rejects checkout, rotation, and update requests.

This action is the only way to set a credential as inactive. The `active` field is derived and cannot be sent in a create or update request. This endpoint is part of the A2A API v2 surface for credentials. The v1 equivalent is documented in [DELETE | Disable credential](/v4-2/docs/api-del-disable-credential).

              Attention

              

API v2 has no endpoint that permanently deletes a credential. Deactivation is the only mechanism available for taking a credential out of active use. A credential deactivated through this endpoint keeps its identification code, its history, and its audit trail.

---

## Prerequisites

- An application authorization granted by the administrator in A2A, with its PAM resource permission set to **Read and write**. For more information, access [How to manage authorizations in A2A](/v4-2/docs/api-v2-how-to-manage-authorizations-in-a2a).
- A valid OAuth 2.0 access token. For more information, access [How to authenticate an application in A2A](/v4-2/docs/how-to-authenticate-an-application-in-a2a).
- The credential must be active. Deactivating a credential that is already inactive returns `409`.

---

## Request

`POST` `/api/v2/pam/credentials/{id}/deactivate`

### Path parameters

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | integer | Yes | Unique identification code of the credential. **Note:** this value is assigned by Segura™. |

The request has no body.

---

### Example request

`POST` `{{url}}/api/v2/pam/credentials/12/deactivate`

---

## Response

```
HTTP/1.1 204 No Content
```

The response has no body. To confirm the new state, retrieve the credential with [GET | List a credential by [id]](/v4-2/docs/api-v2-get-list-a-credential) and check the `credential.active` field.

---

## What changes after deactivation

| Operation | Behavior on an inactive credential |
| --- | --- |
| Read requests | Succeed. The credential returns `200` with `credential.active` set to `false`. |
| Write requests and actions | Rejected with `409` and the code `api.resource.inactive`. This covers full and partial updates and [password rotation](/v4-2/docs/api-v2-post-rotate-credential). |
| Activation | Succeeds. Use [POST \| Activate credential](/v4-2/docs/api-v2-post-activate-credential) to return the credential to active use. |

---

## Errors

| HTTP code | Message | Possible cause | Solution |
| --- | --- | --- | --- |
| `401` | `api.auth.token.invalid` | The access token is missing or has expired. | Request a new access token. |
| `403` | `api.permission.denied` | The authorization does not have permission to update credentials. | Ask the administrator to set the PAM resource permission to **Read and write** in A2A, then generate a new token. |
| `404` | `api.resource.not_found` | The credential does not exist, or it is outside the scope of the authorization. | Check the identification code sent in the path. |
| `409` | `api.resource.conflict.already_inactive` | The credential is already inactive. | No action is needed, the credential is already in the requested state. |
| `429` | `rate_limit_exceeded` | The request rate limit was exceeded. | Reduce the request rate and try again. |
| `500` | `api.internal.error` | Internal server error. | Contact the Segura™ support team. |

### Example error response

`409` the credential is already inactive:

```
{
    "error": {
        "code": "api.resource.conflict.already_inactive",
        "message": "Credential is already inactive."
    }
}
```

              Info

              

This action is not idempotent. Repeating it on a credential that is already inactive returns `409` rather than `204`. Retrieve the credential's current state before retrying a request whose outcome you are unsure of.

---

## Related documents

- [POST | Activate credential](/v4-2/docs/api-v2-post-activate-credential)
- [POST | Check in credential](/v4-2/docs/api-v2-post-checkin-credential)
- [GET | List a credential by [id]](/v4-2/docs/api-v2-get-list-a-credential)

For authentication error messages, the `403` versus `404` policy, and the current limits of the `meta.actions` block, access [API v2 - Conventions and shared behaviors](/v4-2/docs/api-v2-conventions-and-shared-behaviors).