API Keys

Revoke Composio API keys

Changed on

Public endpoint for reporting and revoking Composio API keys that have been leaked (e.g. via the GitHub Secret Scanning Partner Program, third-party scanners, or self-reported leaks). Accepts project (ak_), user (uak_), and org (oak_*) keys in a single batch. Matched keys are revoked and stop working immediately. The response shape is constant regardless of whether any submitted key matched, so callers cannot use this endpoint to probe key existence. If a key cannot be revoked, the endpoint returns 500 and the request should be retried. The endpoint is rate limited; requests over the limit receive a 429.

post/api/v3.1/api_key_revocation

Request

  • Base URL
    https://backend.composio.dev
  • URL
    https://backend.composio.dev/api/v3.1/api_key_revocation
  • Auth
    no_auth (a scheme the document does not define)

Request body

api_keysstring[] required

Composio API keys to revoke. Accepts project (ak_), user (uak_), and org (oak_*) keys. Each batch is capped at 100 entries.

Response

Revocation request received

receivedboolean required

Always true when the request body is valid. The response intentionally does not reveal whether any submitted key matched a record.

Changes