Revoke API Key - LeadLex

Request

Revocation is a soft delete: the key row is preserved in the api_keys table with revoked_at populated, so audit trails and last-used timestamps remain queryable. All requests using the key after revocation fail with 401 invalid_key. There is no “unrevoke” - create a new key if needed.

Path Parameters

string

required

API key UUID.

Headers

Authorization: Bearer wbk_your_api_key_here

Idempotency-Key

string

Optional UUID. Repeated revokes with the same key return the same result without erroring.

Response

On success returns HTTP 204 No Content. The response still carries X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and X-Request-ID for observability.

curl -X DELETE \
  https://data.leadlex.com/functions/v1/api-gateway/v1/api-keys/key_01HY1 \
  -H "Authorization: Bearer wbk_your_api_key_here" \
  -i

Example Response

HTTP/1.1 204 No Content
X-Request-ID: req_01HY1K0E7V8Q0YXH7DSTX5B3CA

Errors

Status	Code	Description
401	`invalid_key`	Invalid or expired API key
403	`insufficient_permissions`	Missing `admin:api_keys` permission, or the calling key is the last active admin key
404	`not_found`	API key not found
429	`rate_limited`	Rate limit exceeded

​Request

​Path Parameters

​Headers

​Response

​Example Response