Developer
Revoke API Key
Deactivate an API key. Revocation is persisted immediately and cannot be undone; a key that was recently in use may keep authenticating for up to five minutes while the verification cache expires.
DELETE
Revoke an API key
Revokes an API key. The key is soft-deactivated rather than deleted: the
revocation is written before the
200 is returned, and the key stays in your
records with its history. Authentication filters on the active flag, but the
API caches keys that have already passed verification for five minutes and
does not clear that cache on revoke — so a key that was used in the last few
minutes may continue to authenticate on that API instance for up to five
minutes after this call returns. A key that has not been used recently is
rejected on its next request. A revoked key cannot be restored —
create a new key and rotate your
integration to it instead. Find key IDs with
GET /v1/developer/keys.
A key may revoke itself. Make sure the caller is not the last active key
for an environment you still depend on. Only owners and admins can call this
endpoint from a dashboard session; members receive 403. API-key callers act
with full tenant access.
Path Parameters
Example Request
Response
Errors
Errors use the standard envelope — see Errors.