Skip to content
AiKYNETIX

Revoke an API key

DELETE
/api/api-keys/{id}/
curl --request DELETE \
  --url http://localhost:8000/api/api-keys/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/ \
  --header 'Authorization: Bearer <token>'

Soft-deletes the key by stamping revoked_at — subsequent auth attempts with this token return 401. Owner-only. The row stays in the database so audit logs continue to reference it; revoked keys disappear from GET /api/api-keys/. Returns 204 on success, 403 for non-owners, 404 if the key doesn’t exist on this team or is already revoked.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Responses

Section titled “Responses”

204

Section titled “204”

No response body

401

Section titled “401”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string
Examplegenerated
{
  "detail": "example"
}

403

Section titled “403”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string
Examples
Example403—NotTheTeamOwner

Only the owner can mint or revoke keys

{
  "detail": "Only the team owner can manage API keys"
}

404

Section titled “404”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string
Examples
Example404—UnknownOrAlready-revokedKey

404 — Unknown or already-revoked key

{
  "detail": "api_key_not_found"
}