---
title: "Revoke API key"
method: DELETE
path: "/api_keys/{id}"
tags: ["API keys"]
---

# Revoke API key

`DELETE /api_keys/{id}`

## Request

- Base URL: `https://arena-predictions.com/api/v1`
- URL: `https://arena-predictions.com/api/v1/api_keys/{id}`
- Auth: one of:
  - API key in cookie `sb-access-token`
  - HTTP bearer

Revoke one key (a rotating key too, which ends its grace). Takes effect on the next request that presents it. Safe to repeat: a second call answers 404 key_not_found, which means it is already gone.

## Path parameters

- `id` string, uuid, required

## Response `200`

Revoked.

- KeyRevokeResponse
  - `key` KeyView, required
    - `id` string, uuid, required
    - `label` string, required
    - `tokenPrefix` string, required: First 16 characters of the token, for matching a row to a key. Never the token.
    - `scopes` string[], required
    - `status` 'active' | 'rotating' | 'revoked' | 'expired', required: rotating: replaced by a rotation and still inside its grace period (it works until expiresAt).
    - `createdAt` string, date-time, required
    - `lastUsedAt` string, date-time, nullable, required: Updated at most once an hour.
    - `expiresAt` string, date-time, nullable, required
    - `revokedAt` string, date-time, nullable, required
    - `createdVia` 'web' | 'cli', required: web: Settings. cli: arena keys.
    - `rotatedFrom` string, uuid, nullable, required: The key this one replaced by rotation.
    - `rotatedAt` string, date-time, nullable, required: When this key was rotated.
    - `requestsThisMonth` integer, required: Keyed requests counted against this key this month (UTC).
  - `revoked` true, required

## Other responses

- `400`: invalid_request: a cookie-session request that is not same-origin (Sec-Fetch-Site must be same-origin, or Origin must equal this site), or the id is not a uuid.
- `401`: unauthorized (not signed in) or session_required (an API key was presented).
- `403`: guest_account: the session is anonymous.
- `404`: key_not_found: no active key with that id on this account (already revoked, or never yours).
- `500`: Could not revoke the key.

---

[API](https://skmtc.dev/arena-predictions/apis/arena-api.md) · [All operations](https://skmtc.dev/arena-predictions/apis/arena-api/llms.txt) · [OpenAPI document](https://skmtc.dev/arena-predictions/apis/arena-api/revisions/9d89d166dae6?raw)