api-keys

Revoke an API key (soft-delete, idempotent).

Soft-delete an API key by setting revoked_at = NOW().

Idempotent (AC #7): already-revoked key returns 200 (not 500). IDOR guard (AC #9): a key from another tenant returns 404 — same as a non-existent key. The caller learns nothing about other tenants. Immediate effect (AC #6): APIKeyService.verify() filters WHERE revoked_at IS NULL, so the next auth attempt with the revoked key returns 401.

delete/v1/api-keys/{api_key_id}

Request

  • Base URL: https://api.andish.ru (the document declares no server; this is the origin it was published from)
  • URL: https://api.andish.ru/v1/api-keys/{api_key_id}
  • Auth: none declared

Path parameters

api_key_idstring uuid required

Response

Key was already revoked — idempotent no-op

Changes

No recorded changes to this operation across all 1 revision of this API.