# /entitlements/deactivate - Shop-facing revocation of an add-on

**POST /entitlements/deactivate**

Revoke a shop-managed grant when the subscription is cancelled or
expires (called by the NethShop webhook). Same addressing and auth as
`POST /entitlements/activate` (`manage:entitlements` permission).
The revocation is soft and idempotent.

When `source_ref` is provided it is matched against the grant: a
PENDING activation with the same ref is cleared instead of revoked
(order cancelled before payment), and a grant whose `source_ref`
differs is left untouched — cancelling an old order can never revoke
an entitlement another order paid for.



## Servers
- Backend API server (port 8080): https://api.your-domain.com/api (Backend API server (port 8080))
- Collect API server (port 8081): https://collect.your-domain.com/api (Collect API server (port 8081))


## Authentication methods
- Bearer auth


## Parameters



### Body: application/json (object)

- **system_key** (string)
  Key of the system to revoke the add-on from

- **entitlement** (string)
  Canonical catalog id or legacy alias of the add-on

- **scope** (string)
  Application instance the grant is narrowed to

- **source_ref** (string)
  Free-form reference to the originating record. When set, it is matched against the grant — a pending activation with the same ref is cleared instead of revoked, and a grant owned by a different ref is left untouched.



## Responses
### 200
Entitlement deactivated successfully

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object)
  One add-on grant for one system, optionally narrowed to a single
  application instance via `scope` (omitted = whole system). `active` is
  derived: not revoked and not expired (`valid_until` null = perpetual).
  Revocation is soft (sets `revoked_at`, the row is kept for audit).


### 400
Unknown entitlement

#### Body: application/json (object)
- **code** (integer)
  HTTP error code

- **message** (string)
  Error message

- **data** (object)


### 401
Unauthorized - invalid or missing token

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)


### 403
Forbidden - insufficient permissions

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)


### 404
System not found for this key, or no grant for this (entitlement, scope)

#### Body: application/json (object)
- **code** (integer)
  HTTP error code

- **message** (string)
  Error message

- **data** (object)


### 500
Internal server error

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)



[Powered by Bump.sh](https://bump.sh)