Auth: Approved own-device signed action delete-node.
Request and response
Angle-bracket values describe placeholders, including nested objects and numeric types; these are wire shapes, not captured service data. Replace them before sending.
POST /v1/nodes/<own-node-id>/delete HTTP/1.1
Host: trust-staging.rebellion.systems
Content-Type: application/json
{
"action": {
"action": "delete-node",
"graphKeyId": "<own-device-id>",
"graphNodeId": "<own-node-id>",
"nonce": "<fresh-random-nonce>",
"signedAt": "<current-ISO-timestamp>"
},
"signature": "<base64-action-signature>"
}Response shape:
{
"deletion": {
"graphNodeId": "<own-node-id>",
"status": "deleted",
"deletedAt": "<timestamp>"
},
"graphEpochRoot": "<graph-root>",
"poseidonEpochRoot": "<poseidon-root>",
"eventLogRoot": "<log-root>",
"eventLogSize": "<nonnegative-integer>"
}A node is the stable endpoint for a persona's connections. Binding returns its graphNodeId alongside the device's graphKeyId. Devices may change without moving the node's edges. Node kinds are human and agent; the kind is metadata, not independent evidence of humanhood or delegated authority.
Delete your node
POST /v1/nodes/:graphNodeId/delete accepts a signed action:
{
"action": {
"action": "delete-node",
"graphKeyId": "own-device-id",
"graphNodeId": "own-node-id",
"nonce": "fresh-random-nonce",
"signedAt": "2026-11-04T12:00:00.000Z"
},
"signature": "base64-action-signature"
}The node ID must match both the URL and the signing device's own node. The device must be usable, graph-purpose and approved on a chained node. A quarantined key returns 403 GRAPH_KEY_NOT_APPROVED. Persona credentials and content-signing keys cannot authorize deletion.
Success is 200 with deletion: {graphNodeId, status, deletedAt} and the four epoch commitment fields. status is deleted or already-deleted.
Effects
The node becomes deactivated and cannot participate in reachability. Its device keys are revoked; its own vouches and tags are removed from active use; its handle is released into the normal cooling-off period; external fingerprints are revoked and remain reserved. Recovery cannot revive the node. A later sign-up creates a fresh empty node.
Incoming declarations belong to their sources and remain for those sources to manage. They no longer contribute to paths through the deactivated node. An owner's incident edge listing can show subjectDeactivated: true, allowing that owner to revoke its own declaration.
The deletion appends to history. Existing event-log entries and previously signed attestations remain, and device public keys remain sufficient for certificate status to report revocation.
Retry after a lost response
Sign a new, fresh delete-node action using a key of the deactivated node. A valid repeat returns already-deleted with the original deletion time. A stale request, bad signature or wrong-node target is refused. Do not infer deletion merely from an unrelated request failing.