nodejs/node · error · Error

ID of the trusted relationship to revoke must be specified w

Error message

ID of the trusted relationship to revoke must be specified with the --id option

What it means

Thrown by `npm trust revoke` when the `--id` flag is not provided. The id targets a specific trusted-relationship record to DELETE. The definition marks id as required:true, but this is a runtime guard for the destructured flags value, since flag parsing can yield undefined in some invocation paths.

Source

Thrown at deps/npm/lib/commands/trust/revoke.js:36

    new Definition('id', {
      default: null,
      type: String,
      description: 'ID of the trusted relationship to revoke',
      required: true,
    }),
    globalDefinitions['dry-run'],
    globalDefinitions.registry,
  ]

  async exec (positionalArgs, flags) {
    const dryRun = this.config.get('dry-run')
    const pkgName = positionalArgs[0] || (await this.optionalPkgJson()).name
    if (!pkgName) {
      throw new Error('Package name must be specified either as an argument or in the package.json file')
    }
    const { id } = flags
    if (!id) {
      throw new Error('ID of the trusted relationship to revoke must be specified with the --id option')
    }
    this.dialogue`Attempting to revoke trusted configuration for package ${pkgName} with id ${id}`
    if (dryRun) {
      return
    }
    const spec = npa(pkgName)
    const uri = `/-/package/${spec.escapedName}/trust/${encodeURIComponent(id)}`
    await otplease(this.npm, this.npm.flatOptions, opts => npmFetch(uri, {
      ...opts,
      method: 'DELETE',
    }))
    this.dialogue`Revoked trusted configuration for package ${pkgName} with id ${id}`
  }
}

module.exports = TrustRevoke

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Run `npm trust list <pkg>` first to obtain the relationship id.
2. Add `--id <relationship-id>` to the revoke command.
3. Double-check the id is the trust record id (typically a slug/hash), not the package name or version.

Example fix

// before
npm trust revoke @my-scope/my-pkg
// after
npm trust revoke @my-scope/my-pkg --id 01HVabc...

if (!flags.id || typeof flags.id !== 'string') {
  throw new Error('Revoke requires --id; run `npm trust list <pkg>` to obtain it')
}

const hasTrustId = (flags) =>
  Boolean(flags && typeof flags.id === 'string' && flags.id.length > 0)

try {
  await trustRevoke.exec([pkg], flags)
} catch (err) {
  if (/--id option/i.test(err.message)) {
    // first run `npm trust list <pkg>`, capture id, then retry
  } else { throw err }
}

When it happens

Trigger: Running `npm trust revoke <pkg>` without `--id`, or with an empty `--id`. The check fires after the package-name resolution.

Common situations: Forgetting the id returned by a prior `npm trust list`; copy-paste losing the id; confusing the trust id with a package version.

Related errors

• ${this.constructor.providerEntity} must be specified in the
• GitLab CI/CD pipeline file must be just a file not a path
• Package name must be specified either as an argument or in t
• Package name must be specified either as an argument or in t
• At least one permission flag is required (--allow-publish, -

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/edb748f83c867c66. Report an issue: GitHub.