Skip to main content
DELETE
Revoke API Key

Request

Revocation is a soft delete: the key row is preserved in the api_keys table with revoked_at populated, so audit trails and last-used timestamps remain queryable. All requests using the key after revocation fail with 401 invalid_key. There is no “unrevoke” - create a new key if needed.

Path Parameters

string
required
API key UUID.

Headers

string
Optional UUID. Repeated revokes with the same key return the same result without erroring.

Response

On success returns HTTP 204 No Content. The response still carries X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and X-Request-ID for observability.

Example Response

Errors