Flips this credential's bit in the unified Token Status List, so verifiers refuse it from their next list fetch — for a leaked presentation, a merchant that offboards, or any single artifact that has to stop working before it expires. Any credential type revokes here, addressed by the jti the issuance log records. The revocation is scoped to this one credential: the subject keeps its authorization, so a replacement is a fresh mint away. Nothing is deleted — the issuance record is evidence and stays readable at GET /issued_credentials/{jti} with status: REVOKED; this action answers with that record. Idempotent: revoking an already-revoked credential changes nothing and returns the same record.