PingOne

Managing a credential

You can revoke, delete, or reset a credential in PingOne if it’s no longer valid.

Revoking a credential

You can revoke a credential if it’s no longer valid and should be removed.

To revoke a credential, you change the issuance rule or SCIM filter. You can remove or change the group, population, or custom filter so that the user no longer matches the rule or filter. You can also revoke a credential from a user on the Users page. Learn more in Managing a user’s credentials.

You can only delete a credential through the API.

To revoke credentials in PingOne Credentials:

Steps

  1. In the PingOne admin console, go to Digital Credentials > Schemas. Click the relevant credential to open the details panel.

  2. On the Population, Group, or Custom tab, click the Pencil icon ().

    Choose from:

    • Select Populations and on the Selected Populations tab, click the population to revoke credentials.

    • Select Groups and on the Selected Groups tab, click the group to revoke credentials.

    • Select Custom and delete or edit conditions to revoke permissions based on different criteria.

  3. Click Update.

Result

Credentials for users no longer meeting the criteria are revoked.

Deleting and resetting a credential

You can remove a credential record from a user’s profile in the PingOne admin console. Depending on how the credential was issued and its current status, either a Delete or Reset action displays. These actions allow a user to receive a new credential after a previous one has been revoked.

Action Description

Reset

Appears only when the following conditions are met:

  • Credential status is Revoked.

  • Issuance source indicates it was issued by an issuance rule.

When you select Reset, the credential record is deleted, and PingOne evaluates whether the user still matches the criteria for the issuance rule:

  • If the user still matches the issuance rule criteria, PingOne allows the credential to be reissued automatically according to the rule configuration.

  • If the user no longer matches the issuance rule criteria, no further action occurs after the record is deleted.

Delete

Appears when either of the following conditions is met:

  • Credential status isn’t Revoked.

  • Credential was manually issued (without an issuance rule).

When you select Delete, the credential record is permanently removed from the user profile.

Learn more in Managing a user’s credentials.