---
title: "POST /#X-Amz-Target=TrentService.RevokeGrant"
method: POST
path: "/#X-Amz-Target=TrentService.RevokeGrant"
---

# POST /#X-Amz-Target=TrentService.RevokeGrant

`POST /#X-Amz-Target=TrentService.RevokeGrant`

Deletes the specified grant. You revoke a grant to terminate the permissions that the grant allows. For more information, see [Retiring and revoking grants](https://docs.aws.amazon.com/kms/latest/developerguide/managing-grants.html#grant-delete) in the __Key Management Service Developer Guide__ .

When you create, retire, or revoke a grant, there might be a brief delay, usually less than five minutes, until the grant is available throughout KMS. This state is known as _eventual consistency_. For details, see [Eventual consistency](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency) in the __Key Management Service Developer Guide__ .

For detailed information about grants, including grant terminology, see [Grants in KMS](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html) in the __Key Management Service Developer Guide__ . For examples of working with grants in several programming languages, see [Programming grants](https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html).

**Cross-account use**: Yes. To perform this operation on a KMS key in a different Amazon Web Services account, specify the key ARN in the value of the `KeyId` parameter.

**Required permissions**: [kms:RevokeGrant](https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html) (key policy).

**Related operations:**

*   CreateGrant
    
*   ListGrants
    
*   ListRetirableGrants
    
*   RetireGrant

## Headers

- `X-Amz-Target` 'TrentService.RevokeGrant', required

## Request body

- RevokeGrantRequest
  - `KeyId` string, required — <p>A unique identifier for the KMS key associated with the grant. To get the key ID and key ARN for a KMS key, use <a>ListKeys</a> or <a>DescribeKey</a>.</p> <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p> <p>For example:</p> <ul> <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> </ul> <p>To get the key ID and key ARN for a KMS key, use <a>ListKeys</a> or <a>DescribeKey</a>.</p>
  - `GrantId` string, required — Identifies the grant to revoke. To get the grant ID, use <a>CreateGrant</a>, <a>ListGrants</a>, or <a>ListRetirableGrants</a>.

## Response `200`

Success

## Other responses

- `480` — NotFoundException
- `481` — DependencyTimeoutException
- `482` — InvalidArnException
- `483` — InvalidGrantIdException
- `484` — KMSInternalException
- `485` — KMSInvalidStateException

---

[API](https://skmtc.net/aws/apis/kms.md) · [All operations](https://skmtc.net/aws/apis/kms/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/kms/versions/f92d678d2025/schema)