{
  "slug": "firebase-apphosting-secrets-revokeaccess-command-218ea1e43bf8",
  "title": "firebase apphosting:secrets:revokeaccess command",
  "tools": [
    "firebase"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-18T22:44:54.000Z",
  "announced_at": "2026-06-18T22:44:54.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When revoking a secret’s access for an App Hosting backend, run `firebase apphosting:secrets:revokeaccess` with the secret name and backend ID; add `--location` if needed to identify the backend’s region. The command changes secret permissions and does not edit deployment configuration.",
    "examples": [
      "firebase apphosting:secrets:revokeaccess <secret-name> --backend=<backend-id> [--location=<region>]"
    ],
    "gotchas": [
      "Version: v15.22.0",
      "<secretNames> (required): Secret name; comma-separate multiple secret names.",
      "--backend <backend> (required): Backend whose service-account access is revoked; mutually exclusive with `--emails`.",
      "--location <location>: Backend location. Cannot be combined with `--emails`; if omitted, the CLI prompts to select the backend location.",
      "--emails <emails>: Comma-delimited user or group emails to revoke access from; mutually exclusive with `--backend`.",
      "Prerequisite: Authenticate the Firebase CLI; the command also ensures the Secret Manager and App Hosting APIs are enabled.",
      "Prerequisite: The caller needs `secretmanager.secrets.get`, `secretmanager.secrets.getIamPolicy`, and `secretmanager.secrets.setIamPolicy` permissions.",
      "Prerequisite: Use firebase-tools v15.22.0 or later for this newly added command.",
      "Docs conflict: The Firebase CLI reference page lists `apphosting:secrets:grantaccess` and other App Hosting secret commands but omits `apphosting:secrets:revokeaccess`; v15.22.0 tagged source defines the new command. https://firebase.google.com/docs/cli"
    ]
  },
  "why_it_matters": "Revoke access to an App Hosting secret while maintaining a repository's deployment configuration.",
  "sources": [
    "https://github.com/firebase/firebase-tools/releases/tag/v15.22.0",
    "https://github.com/firebase/firebase-tools/blob/v15.22.0/src/commands/apphosting-secrets-revokeaccess.ts"
  ],
  "rank": 0.92015,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-5dbfcb5292980006-0:gate",
    "evidence_hash": "ece0bf67ca4464c6ff8ae9281e68357ba93ce6a79966defcb8d1b9ea723657ee"
  },
  "review": {
    "draft_hash": "fa64491c441b9fe2758cc261de0e4d7d906ded70e3e90286890880a9b308c174",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.92 >= 0.9; 2 needed) and Jev gave 0.72 (>= 0.6 needed)."
  }
}