Unpublish an Agent — POST /v1/agents/:agent_id/unpublish

Remove a published agent from the registry with a signed request proving provider DID ownership. The agent is revoked and no longer invocable.

Revokes a published agent and removes it from the active registry. The request must be signed with the Ed25519 private key corresponding to the provider’s current DID, proving that the request originates from the legitimate provider.

Once unpublished, the agent’s status is set to "revoked" and the gateway will reject any subsequent invocation attempts.

Request

curl -X POST http://your-node:8042/v1/agents/stripe-agent/unpublish \
  -H 'content-type: application/json' \
  -d '{
    "provider_id": "acme-labs",
    "provider_did": "did:key:z6MkhaXgBZDvotD1X9gRrYkM5Xq9jYQqK6d8r8bQdE1mV2Xa",
    "signature": "<BASE64_ED25519_SIGNATURE>",
    "nonce": "unique-nonce-001",
    "issued_at_ms": 1736934000000,
    "expires_at_ms": 1736934300000,
    "reason": "Agent decommissioned"
  }'

The signature must be an Ed25519 signature over the canonical unpublish payload, which encodes the fields action, provider_id, provider_did, agent_id, nonce, issued_at_ms, expires_at_ms, and reason as a JSON object.

Path parameters

agent_id · string · required

The unique identifier of the published agent to unpublish.

Body parameters

provider_id · string · required

The provider_id of the provider that owns this agent.

provider_did · string · required

The current DID of the provider (e.g. "did:key:z6Mk…"). Must match the DID on record.

signature · string · required

Base64-encoded Ed25519 signature over the canonical unpublish payload, signed with the private key for provider_did.

nonce · string · required

Unique string to prevent replay attacks. The node may reject requests that reuse a nonce from the same provider.

issued_at_ms · integer · required

Unix timestamp in milliseconds when this request was signed. The node rejects requests with timestamps too far in the past or future.

expires_at_ms · integer · required

Unix timestamp in milliseconds after which this request must be rejected, even if the signature is valid.

reason · string

Optional human-readable explanation for unpublishing the agent.

Response

Returns the updated PublishedAgentRecord with status set to "revoked".

agent_id · string

The agent identifier.

provider_id · string

The owning provider’s identifier.

version · string

The version of the agent at the time it was unpublished.

status · string

Always "revoked" after a successful unpublish.

agent_card · object

The agent’s A2A card (preserved for audit purposes).

deployment · object

The agent’s deployment configuration (preserved for audit purposes).

review · AgentReviewProfile

The agent’s review profile (preserved for audit purposes).

approved_at · string

ISO 8601 timestamp of original approval.

updated_at · string

ISO 8601 timestamp of this unpublish event.

reviewed_by · string

Identity of the original reviewer.

review_notes · string

Original reviewer notes, if any.

Status codes

Code	Meaning
200 OK	Agent unpublished successfully. Returns the updated PublishedAgentRecord.
400 Bad Request	Missing required fields, invalid signature, or the request has expired.
403 Forbidden	The provider_did or provider_id does not match the record on file.
404 Not Found	No published agent with the given agent_id exists on this node.

Example response

{
  "agent_id": "stripe-agent",
  "provider_id": "acme-labs",
  "version": "1.2.0",
  "status": "revoked",
  "agent_card": {
    "name": "Stripe Agent",
    "description": "Handles Stripe payment flows",
    "url": "https://stripe-agent.example.com",
    "preferredTransport": "JSONRPC",
    "protocolVersion": "1.0",
    "supportsTask": false,
    "skills": [{ "id": "payments.create_link", "name": "Create Payment Link" }],
    "securitySchemes": { "oauth2": { "type": "oauth2" } },
    "security": [{ "oauth2": ["payments:write"] }]
  },
  "deployment": {
    "runtime": "remote_http",
    "endpoint": {
      "url": "https://stripe-agent.example.com/a2a",
      "protocol_binding": "JSONRPC",
      "protocol_version": "1.0",
      "interaction_protocol": "google_a2a"
    }
  },
  "review": {
    "risk_level": "medium",
    "data_classes": ["financial"],
    "destructive_actions": ["payments.refund"],
    "human_approval_required": true,
    "allowed_regions": ["AU", "US"]
  },
  "approved_at": "2025-01-16T08:00:00Z",
  "updated_at": "2025-06-01T09:15:00Z",
  "reviewed_by": "auto-approve"
}