The WAF++ validation gateway publishes revocation information in two forms.
Real-time revocation lookup
Check the current status of any validation by ID:
curl https://validate.waf2p.dev/api/v1/validations/{validation_id}/verify
The response contains status. A value of revoked means the validation has
been invalidated by the gateway.
Revocation list
The gateway also publishes a machine-readable revocation list at:
/api/v1/revocations
The list contains every validation ID that has been revoked, the revocation timestamp, and the reason code.
Reasons for revocation
Validations may be revoked by the gateway for the following reasons:
| Reason code | Meaning |
|---|---|
key_compromise |
The signing sub-CA key was compromised or rotated. |
affiliation_changed |
The project ownership or scope changed materially. |
superseded |
A newer validation supersedes the prior one. |
cessation_of_operation |
The project or server deployment was decommissioned. |
privilege_withdrawn |
The server sub-CA was withdrawn by the gateway. |
What happens after revocation
- Verification requests for a revoked validation return
status: revoked. - Badges and certificates linked to a revoked validation display a revoked state.
- The signed validation envelope itself still exists, but the gateway no longer vouches for it.
Checking offline
Validation envelopes include the full certificate chain. A verifier with the root certificate can detect revoked server sub-CA certificates by checking the revocation list from the gateway or by the real-time verify endpoint.