Revocation

What happens to an open subscription when a session ends, a membership changes or a grant is revoked, and how a client should react.

  • Availability: Planned
  • Evidence: Read from source
  • Explanation

The problem

Checking access when someone joins a channel is not enough. A person can be removed from an organization, lose a role, or sign out while a subscription is open. If nothing else happened, that subscription would keep receiving events about resources the person may no longer see.

What the service does

When a session, a membership or a grant changes, the service re-evaluates the affected subscriptions instead of waiting for them to end:

  1. It publishes access.revoked on each affected channel. The event is immediate: it is never delayed or merged.
  2. The transport closes the subscription.
  3. From then on the management API answers 403 ACCESS_REVOKED to that session or grant, and 404 NOT_FOUND for resources the caller can no longer see. Snapshots and replays are refused in the same way, so a closed subscription cannot be replaced by polling.

Realtime grants are short-lived on purpose. Even if a revocation notice were lost, a grant that is not renewed ends by itself, and renewing requires a fresh access check.

What a client does

You receive Do this
access.revoked on a channel Stop applying events for it, drop the state you hold for that scope and leave the channel. Do not reconnect in a loop.
403 ACCESS_REVOKED from any request The session or grant ended. Sign in again, or tell the person their access changed.
404 NOT_FOUND for something you were watching Treat it as gone. The service does not say whether it was deleted or hidden.
Your grant is about to expire Request a new grant before expires and rejoin with it

Limits

Revocation is bounded, not instantaneous: there is a short window between the change and the closed subscription. Do not send anything through events that would be harmful to see during that window. The service never puts credentials, tokens or another tenant's data in events or logs in the first place.

Guests of private applications hold delivery access to one application. They have no management session and no events.subscribe capability, so they never join these channels. How a guest's delivery access is revoked is covered in Private access.