Revoke an API key

Permanently deletes the API key from the project. Returns 204 No Content on success. A key belonging to another project is indistinguishable from a missing one — both return 404.

Revoking CASCADES. The key is deleted, and so is every key descended from it: keys it created, keys those keys created, and so on. A key that can mint keys would otherwise outlive its own revocation — revoke the compromised credential and the key it quietly created keeps working. The whole subtree goes in one statement, so there is no moment at which the parent is gone and a descendant still authenticates.

The number of keys actually deleted (this one plus its descendants) is returned in the X-Revoked-Count response header. The cascade cannot leave the project: a key in another project is never reached, whatever it claims as its creator.

Regenerating a key from the dashboard is deliberately NOT a cascade. Rotating a credential is not a request to destroy everything it made, so the descendants survive and their created_by_key_id becomes null.