---
title: "Revoke an API key (soft-delete, idempotent)."
method: DELETE
path: "/v1/api-keys/{api_key_id}"
tags: ["api-keys"]
---

# Revoke an API key (soft-delete, idempotent).

`DELETE /v1/api-keys/{api_key_id}`

## Request

- Base URL: `https://api.andish.ru` (the document declares no server; this is the origin it was published from)
- URL: `https://api.andish.ru/v1/api-keys/{api_key_id}`
- Auth: none declared

Soft-delete an API key by setting revoked_at = NOW().

Idempotent (AC #7): already-revoked key returns 200 (not 500).
IDOR guard (AC #9): a key from another tenant returns 404 — same as
a non-existent key.  The caller learns nothing about other tenants.
Immediate effect (AC #6): APIKeyService.verify() filters WHERE revoked_at IS NULL,
so the next auth attempt with the revoked key returns 401.

## Path parameters

- `api_key_id` string, uuid, required

## Response `200`

Key was already revoked — idempotent no-op

## Other responses

- `204`: Key revoked successfully
- `401`: Not authenticated or API-key auth used (JWT required)
- `404`: Key not found or belongs to another tenant (IDOR-safe)
- `422`: Validation Error

---

[API](https://skmtc.dev/andish/apis/mnemo-api.md) · [All operations](https://skmtc.dev/andish/apis/mnemo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/andish/apis/mnemo-api/revisions/d5449f23414c?raw)