The revocation feed

GET

/security/klock/revocations

Sessions, devices and certificates revoked after since, as a compact
JWS (typ klock-revocations+jws) signed with the grant key, so a
client verifies it against the keyset. Up to 500 entries a page; more
says there is another — ask again with the last seq. Public, and
cacheable for 30 seconds.

Request

Query Params

Responses

🟢200

application/jose

A compact JWS whose payload is

{ seq, entries: [{ seq, kind:
session|device|cert, ref, at, reason? }], iat, more? }

Headers

Bodyapplication/jose

🟠400

🔴503KlockUnavailable

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/klock/revocations?since='

Response Example

200 - Example 1

"string"

Modified at 2026-10-05 04:04:32

A guest grant

The published keyset