Rotating Credentials Is Not Revoking Them. The Revocation Unit Decides Whether You Can.
Rotation issues new secrets. Revocation removes the authority of everything that could have used the old ones. Whether you can do the second depends on a design decision made long before the incident: the revocation unit.