Revoke a specific consumer-owned API key
Soft-revokes (is_revoked=true + revoked_at=now() atomically — both columns must move together to satisfy the chk_revoked_consistency CHECK from a required database migration and the consumer_revoke_own_keys WITH CHECK a required database migration). Idempotent: revoking an already-revoked key returns 404. Cross-tenant isolation: explicit .eq('consumer_id', $1) filter AS WELL AS RLS. Session-cookie auth. The 404 response deliberately collapses three cases — wrong owner, already revoked, id doesn't exist — so an attacker cannot enumerate the consumer-key space across tenants (IDOR defense). Inline rate-limit 30/hour per consumer, fail-CLOSED.
Request
- Base URL: https://www.apier.no
- URL: https://www.apier.no/api/v1/account/keys/{id}
- Auth: API key in cookie sb-access-token
Path parameters
Key id (UUID). 400 if not a valid UUID — the boundary Zod parse rejects before any DB call.
Response
Key revoked.
Example response
{
"_meta": {
"rulebook_version": "v1.0.0",
"source": "apier.no",
"data_source": "Brønnøysund Enhetsregisteret + Apier Universal Rulebook",
"schema_version": "1.0.0",
"legal_basis": "NLOD — public registry reuse",
"response_timestamp": "2026-04-24T12:00:00.000Z",
"response_hash": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"source_snapshot_id": "brreg-2026-04-24T02:00:00.000Z",
"cost_nok": 0.5,
"wallet_remaining_nok": 9.5,
"spend_cap_remaining_nok": 12.5
}
}Changes
No recorded changes to this operation across all 1 revision of this API.