Skip to main content
DELETE
Revoke an API key
Revokes an API key. The key is soft-deactivated rather than deleted: the revocation is written before the 200 is returned, and the key stays in your records with its history. Authentication filters on the active flag, but the API caches keys that have already passed verification for five minutes and does not clear that cache on revoke — so a key that was used in the last few minutes may continue to authenticate on that API instance for up to five minutes after this call returns. A key that has not been used recently is rejected on its next request. A revoked key cannot be restored — create a new key and rotate your integration to it instead. Find key IDs with GET /v1/developer/keys. A key may revoke itself. Make sure the caller is not the last active key for an environment you still depend on. Only owners and admins can call this endpoint from a dashboard session; members receive 403. API-key callers act with full tenant access.

Path Parameters

Example Request

Response

Errors

Errors use the standard envelope — see Errors.

Authorizations

Authorization
string
header
required

Tenant API key obtained from POST /auth/register or POST /v1/developer/keys.

Path Parameters

id
string<uuid>
required

Response

Key revoked.

status
string
Allowed value: "revoked"