Revoke a key without deleting it
Stop a key working, and keep the row.
/v1/api-keys/{key_id}/revokeAdmin- Operation id
- revoke_api_key
- Access
- An editor or a viewer is refused.
/v1/api-keys/{key_id}/revokeStop a key working, and keep the row.
This is the response to a leaked or retired secret. The key stops
authenticating from the next request: there is no grace period and no
token to wait out. The row stays, so the key keeps its name, its prefix and
its last-used time for anyone asking later what the key was and who minted
it. GET /v1/api-keys hides it unless you ask for revoked keys.
Revocation is one way. A revoked key cannot be brought back, and the replacement is a new key with a new secret.
Revoking twice is refused with 404, the same answer as a key id that is not in this workspace. That is deliberate: this route only reports success when it actually changed something, so a 200 is proof the key is now dead rather than proof it was addressed.
Tenancy: the request is scoped to one workspace, and the credential presented is what selects it. A caller with no membership in that workspace is refused with 404, which is indistinguishable from a workspace that does not exist.
Authorisation: admin or owner. An editor or viewer receives 403 insufficient_role.
Access: Authorization: Bearer carrying either a realm access token or an API key. A key must hold the admin-resources:write scope, and the workspace role of the person who owns it must meet the floor above.
A realm-issued access token, presented as Authorization: Bearer <token>. It acts as the person who signed in, and every operation resolves their workspace role live from the membership record.
In: header
Path Parameters
uuidResponse Body
application/json
application/json
curl -X POST "https://example.com/v1/api-keys/497f6eca-6276-4993-bfeb-53cbbbba6f08/revoke"{ "id": "8f14e45f-ceea-4f4e-9c1f-2b0b2b7d4a11", "revoked": true}