Revocation and status checking are controls that confirm whether a digital credential is still valid at the time it is presented. Revocation lets an issuer invalidate a credential early, while status checking lets a verifier confirm current validity. Together they prevent expired or compromised credentials from being trusted.
Expanded Definition
Revocation and status checking are paired lifecycle controls for NHI credentials such as API keys, certificates, tokens, and service account material. Revocation is the issuer action that invalidates a credential before its natural expiration, while status checking is the verifier action that asks whether the credential is still valid at the moment of use.
In NHI operations, these controls matter because machine identities are often consumed automatically, across services, and at high frequency. A credential can be technically unexpired yet no longer trustworthy if it has been exposed, rotated, or offboarded. That is why implementation often combines NIST Cybersecurity Framework 2.0 lifecycle thinking with issuer- and verifier-side checks, especially where applications cannot safely rely on expiration alone.
Definitions vary across vendors on whether “status checking” includes certificate path validation, token introspection, or both, so practitioners should separate the question of format from the question of trust. The most common misapplication is treating expiry time as revocation, which occurs when a compromised credential remains trusted until its scheduled end date.
Examples and Use Cases
Implementing revocation and status checking rigorously often introduces latency and operational dependency on the issuer, requiring organisations to weigh stronger trust decisions against added lookup complexity.
- A service account key is discovered in a repository, so the issuer revokes it immediately and downstream services reject it on the next status check.
- A short-lived certificate is renewed during rotation, and verifiers check current revocation status before accepting the old certificate during the overlap window.
- An API gateway validates opaque access tokens through introspection rather than assuming validity until expiry, which is common in tightly governed environments.
- An offboarded third-party integration is removed from trust by revoking its credential set and confirming that every consumer performs active status checks.
- NHIMG reports that only 20% of organisations have formal processes for offboarding and revoking API keys, which shows why status checks must be paired with lifecycle discipline in practice. See Ultimate Guide to NHIs and the standards context in NIST Cybersecurity Framework 2.0.
In environments that use certificate status services, revocation checks are especially important when trust spans many services and immediate access removal is required after compromise or offboarding.
Why It Matters in NHI Security
When revocation and status checking are weak, compromised NHIs can continue operating long after discovery, turning a single secret leak into persistent unauthorized access. This is especially dangerous for service accounts, automation pipelines, and third-party integrations because they often bypass interactive review and keep calling systems until someone actively cuts them off.
NHIMG research shows that 91.6% of secrets remain valid five days after an organisation is notified, which highlights how slowly remediation can lag behind detection. That gap is exactly where revocation and status checking become decisive, because a secret that still validates is still exploitable. The issue is closely tied to broader NHI governance concerns documented in the Ultimate Guide to NHIs, including visibility, rotation, and offboarding, and it aligns with lifecycle controls expected under NIST Cybersecurity Framework 2.0.
Organisations typically encounter the business impact only after a credential has already been abused, at which point revocation and status checking become operationally unavoidable to contain the incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Covers credential lifecycle and invalidation checks for non-human identities. |
| NIST CSF 2.0 | PR.AA-01 | Identity proofing and access assurance depend on current credential validity. |
| NIST Zero Trust (SP 800-207) | JIT access and continuous verification | Zero Trust requires ongoing validation rather than one-time credential trust. |
| NIST SP 800-63 | SP 800-63B | Authenticator lifecycle guidance supports revocation and validity checking. |
| CSA MAESTRO | identity and access governance | Agentic systems need active credential governance and invalidation paths. |
Revoke exposed NHI credentials fast and require live status validation before each trust decision.
Related resources from NHI Mgmt Group
- What breaks when revocation and status checking are not built into digital identity wallet flows?
- Why do short-lived certificates reduce the need for traditional revocation checking?
- Should organisations automate revocation for privileged access?
- What is the difference between token rotation and token revocation?
