---
title: "Revoke a key"
method: POST
path: "/api/keys/{id}/revoke"
tags: ["Keys"]
---

# Revoke a key

`POST /api/keys/{id}/revoke`

## Request

- Base URL: `https://morfee.furo.solutions`
- URL: `https://morfee.furo.solutions/api/keys/{id}/revoke`
- Auth: one of:
  - API key in header `X-Api-Key`
  - HTTP bearer

Immediate: anything holding that key stops working on its next call. Revoking the key you are calling with is allowed on purpose, and `wasThisKey` says that is what happened. A key that has leaked is exactly when you want that, and refusing would make the fastest way to close the hole the one thing this API would not do.

Needs a key scoped `write` or `full`.

## Path parameters

- `id` string, required

## Response `200`

Revoked, or already was.

- object
  - `ok` boolean
  - `revoked` string
  - `wasThisKey` boolean: True when you have just revoked the key you called with.
  - `alreadyRevoked` boolean: Only present when it was revoked before this call.

## Other responses

- `401`: No key, an unknown key or a revoked one.
- `403`: The key is real and the organization is right, but the scope on it does not cover this. The message names the scope the key has, what that scope may do, and how to get a wider one, because the thing reading it is usually the thing that has to act on it.
- `404`: No key with that id in your organization.

---

[API](https://skmtc.dev/furo/apis/morfee.md) · [All operations](https://skmtc.dev/furo/apis/morfee/llms.txt) · [OpenAPI document](https://skmtc.dev/furo/apis/morfee/revisions/83f95f89653f?raw)