---
title: "Revoke an API key"
method: POST
path: "/apiKeys/{apiKeyId}/revoke"
tags: ["API keys"]
---

# Revoke an API key

`POST /apiKeys/{apiKeyId}/revoke`

## Request

- Base URL: `https://api.cactal.ai/v1`
- URL: `https://api.cactal.ai/v1/apiKeys/{apiKeyId}/revoke`
- Auth: HTTP bearer

Permanently deactivates the key by setting `revokedAt`; requests that use it fail with 401 immediately. Revocation is irreversible — rotate instead if the key should keep working with a new secret. Revoking an already-revoked key is a no-op that returns the current metadata.

## Path parameters

- `apiKeyId` string, required

## Response `200`

The revoked key metadata.

- object
  - `id` string, required: Unique id of the API key.
  - `name` string, required: Human-readable label, 1–200 characters.
  - `organizationId` string, required: Id of the organization that owns the key.
  - `access` union, required: Access configuration of an API key: either one organization-wide role, or one role across an explicit set of websites. The `owner` role can never be granted to an API key.
    - object
      - `kind` 'organization', required: Grants one role across the entire organization.
      - `role` 'admin' | 'full_editor' | 'content_editor', required: Organization-wide role held by the key.
    - object
      - `kind` 'websites', required: Grants one role on an explicit set of websites.
      - `websiteIds` string[], required: Ids of the websites the key can access. All must belong to the organization of the key.
      - `role` 'content_editor' | 'full_editor', required: Role held by the key on each listed website.
  - `expiresAt` string, date-time, nullable, required: When the key stops authenticating. `null` when it never expires.
  - `revokedAt` string, date-time, nullable, required: When the key was revoked. `null` while the key is active.
  - `createdAt` string, date-time, required: When the key was created.

## Other responses

- `400`: Validation failed. The response `message` names the first invalid field.
- `401`: Missing, invalid, expired, or revoked API key.
- `403`: The authenticated principal lacks the required capability.
- `404`: The resource does not exist or is outside the principal’s access scope.
- `429`: Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header.

---

[API](https://skmtc.dev/cactal/apis/cactal-api.md) · [All operations](https://skmtc.dev/cactal/apis/cactal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cactal/apis/cactal-api/revisions/9cd0fb5eacdd?raw)