---
title: "Revoke an API key."
method: DELETE
path: "/v1/api-keys/{id}"
tags: ["auth"]
---

# Revoke an API key.

`DELETE /v1/api-keys/{id}`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/v1/api-keys/{id}`
- Auth: one of:
  - API key in cookie `dvt_session`
  - HTTP bearer

Revocation (not deletion — the row stays for audit) takes effect immediately. Admin/owner (apikey:manage) may revoke any key in the org. Members with `allowMemberApiKeys` enabled may revoke only their own keys; attempting to revoke another user's key returns 404 (existence not leaked).

## Path parameters

- `id` string, uuid, required

## Response `204`

Revoked (idempotent).

## Other responses

- `401`: Missing, invalid, or expired session.
- `403`: Caller's role is below admin.
- `404`: Resource does not exist.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)