Revoke Enterprise PKI client certificates by serial number or common name. Provide exactly one of serial or cn. Revoking by cn revokes all matching non-revoked PKI certificates. Optional revocation_reason is an integer 0–8 matching the Enterprise PKI console and RFC 5280 ReasonFlags: 0 Unused, 1 Key compromise, 2 CA compromise, 3 Affiliation changed, 4 Superseded, 5 Cessation of Operation, 6 Certificate Hold, 7 Privilege Withdrawn, 8 AA compromise. Enterprise PKI must be enabled. The API key must be writable.