Revocation

Revoking rights to access an encrypted data is a core part of data security management. It helps prevent unauthorized access and misuse of your encrypted data.

In PQVault, access rights are assigned via the following items:

API Keys
Access Tokens
Shares & Share Policies

By keeping an eye on these items and revoking one or more of them when necessary, you can protect your data without deleting an entire user account.

You can easily revoke access rights with the following steps:

With the PQVault online management tool, navigate to the API Keys/Access Tokens/Shares section, find the item you would want to revoke and click on the revoke button next to the item
With the PQVault SDK use the Revoke API for API Keys/Access Tokens/Shares to easily revoke an item with just a line of code
Users or entities that own or are assigned the items will no longer have the access rights that comes with it

Shares and their policies allow you to share access of your encrypted or signed data with other entities or users. The share policies dictates who is able to access, encrypt data or edit policies under a share. As a share creator, you are able to revoke your own shares.

By revoking a share, you will deny everyone from accessing any encrypted data under a share, including yourself; the creator. This allows you to revoke rights on the share level; access to individual encrypted data.

API keys is necessary in order to access the cryptographic operations of PQVault. Without them a user will be denied access to encryption, decryption, signature, verification and much more. API keys are created by developers and the account owner, then assigned to users. So, only the developers and account owner can revoke the keys.

By revoking API Keys, you can remove rights to perform crypto operations of a large group of users in just a few steps. This allows you to revoke rights on a very broad level; access to API keys.

API keys should be revoked when:

the API key is compromised (exposed to public)
the group of users or apps that no longer use the API key

It is advisable to revoke/remove any API keys that is no longer being used.

A few API keys require a Personal Access Token (PAT). Without a PAT access to crypto operations will be denied. In this case, a PAT acts as both the password to use the key and the identifier to who is using the key. A PAT is created by the individual user and can only be revoked by the creator.

By revoking PAT, you can deny malicious actors who have stolen your PAT access to use API keys assigned to you. With this, you can revoke rights on the user/individual level; access to use specific API keys.