Enrollment Retired Payload

Payload emitted when a machine enrollment is deliberately retired — by the factory wipe-and-retest reset (bench stock) or by an Ops admin (in-service RMA/refurb). The event is the durable audit record: a later fresh enrollment replaces the retired DynamoDB tombstone wholesale, so the prior state lives here (PLAT-449).

$id	https://schemas.texecom-prod.com/v2/events/payload/service/identity/enrollment/retired/v1.0.0.json
$schema	http://json-schema.org/draft-07/schema

Properties

Name		Type
serial		String
machineId		String
profile		[string, null]
previousStatus		String
via		String
actor		String
reason		[string, null]
retiredAt		String
ownerAccountId		[string, null]
approvedBy		[string, null]
createdAt		[string, null]
iotCertificateIdsDeactivated		Array

serial

Description	Panel/base serial the enrollment belongs to.
Type	String
Required	Yes

machineId

Description	Enrollment record key — the serial itself (iot-core) or '<serial>.local' (smartcom-local server cert).
Type	String
Required	Yes

profile

Description	Enrollment profile of the retired record.
Type	[string, null]
Required	No

previousStatus

Description	Status the record held immediately before retirement (pending \| approved \| active \| rejected).
Type	String
Required	Yes

via

Description	Which deliberate path retired it.
Type	String
Required	Yes
Enum	factory-reset ops-retire

actor

Description	Authenticated actor: the factory machine's IAM session ARN (factory-reset) or the ops user's subject (ops-retire).
Type	String
Required	Yes

reason

Description	Optional caller-supplied audit note.
Type	[string, null]
Required	No

retiredAt

Description	ISO-8601 timestamp of the retirement.
Type	String
Required	Yes
Format	date-time

ownerAccountId

Description	Owner account linked to the record at retirement, if any — always null for factory-reset (owner-linked serials are refused).
Type	[string, null]
Required	No

approvedBy

Description	Prior-state audit: who approved the retired enrollment.
Type	[string, null]
Required	No

createdAt

Description	Prior-state audit: when the retired enrollment was created.
Type	[string, null]
Required	No

iotCertificateIdsDeactivated

Description	AWS IoT certificate IDs deactivated and detached as part of the retirement (iot-core profile only; empty otherwise).
Type	Array
Required	Yes

Schema

{
    "$id": "https://schemas.texecom-prod.com/v2/events/payload/service/identity/enrollment/retired/v1.0.0.json",
    "$schema": "http://json-schema.org/draft-07/schema",
    "title": "Enrollment Retired Payload",
    "description": "Payload emitted when a machine enrollment is deliberately retired — by the factory wipe-and-retest reset (bench stock) or by an Ops admin (in-service RMA/refurb). The event is the durable audit record: a later fresh enrollment replaces the retired DynamoDB tombstone wholesale, so the prior state lives here (PLAT-449).",
    "type": "object",
    "properties": {
        "serial": {
            "description": "Panel/base serial the enrollment belongs to.",
            "type": "string"
        },
        "machineId": {
            "description": "Enrollment record key — the serial itself (iot-core) or '<serial>.local' (smartcom-local server cert).",
            "type": "string"
        },
        "profile": {
            "description": "Enrollment profile of the retired record.",
            "type": [
                "string",
                "null"
            ]
        },
        "previousStatus": {
            "description": "Status the record held immediately before retirement (pending | approved | active | rejected).",
            "type": "string"
        },
        "via": {
            "description": "Which deliberate path retired it.",
            "type": "string",
            "enum": [
                "factory-reset",
                "ops-retire"
            ]
        },
        "actor": {
            "description": "Authenticated actor: the factory machine's IAM session ARN (factory-reset) or the ops user's subject (ops-retire).",
            "type": "string"
        },
        "reason": {
            "description": "Optional caller-supplied audit note.",
            "type": [
                "string",
                "null"
            ]
        },
        "retiredAt": {
            "description": "ISO-8601 timestamp of the retirement.",
            "type": "string",
            "format": "date-time"
        },
        "ownerAccountId": {
            "description": "Owner account linked to the record at retirement, if any — always null for factory-reset (owner-linked serials are refused).",
            "type": [
                "string",
                "null"
            ]
        },
        "approvedBy": {
            "description": "Prior-state audit: who approved the retired enrollment.",
            "type": [
                "string",
                "null"
            ]
        },
        "createdAt": {
            "description": "Prior-state audit: when the retired enrollment was created.",
            "type": [
                "string",
                "null"
            ]
        },
        "iotCertificateIdsDeactivated": {
            "description": "AWS IoT certificate IDs deactivated and detached as part of the retirement (iot-core profile only; empty otherwise).",
            "type": "array",
            "items": {
                "type": "string"
            }
        }
    },
    "required": [
        "serial",
        "machineId",
        "previousStatus",
        "via",
        "actor",
        "retiredAt",
        "iotCertificateIdsDeactivated"
    ],
    "additionalProperties": false
}

Texecom Event Schemas