Revokes an API key by its ID, so it can no longer be used. This action is irreversible.

The key stops working immediately and drops out of GET /v1/keys, but the record is retained with when it was revoked and by whom.

Requirements:

• Key must belong to the authenticated user's workspace

Key Features:

• Permanently revoke API key access while retaining the audit record
• Idempotent operation (safe to retry)
• Optional Idempotency-Key header for safe retries

Important:

• This action cannot be undone
• Any applications using this key will immediately lose access
• Returns 204 even if the key doesn't exist or is already revoked

Common Use Cases:

• Revoke compromised keys
• Clean up unused keys
• Implement key rotation (revoke old, create new)
• Offboard team members

Required permissions: auth:keys:write. Key presets that include them: FULL. See key permissions.