---
title: "Revoke an API key"
method: DELETE
path: "/api/v1/api-keys/{id}"
tags: ["ApiKeys"]
---

# Revoke an API key

`DELETE /api/v1/api-keys/{id}`

## Request

- Base URL: `https://app.lastping.dev`
- URL: `https://app.lastping.dev/api/v1/api-keys/{id}`
- Auth: API key in header `X-Api-Key`

Permanently deletes the API key from the project. Returns 204 No
Content on success. A key belonging to another project is
indistinguishable from a missing one — both return 404.

**Revoking CASCADES.** The key is deleted, and so is every key
descended from it: keys it created, keys those keys created, and so
on. A key that can mint keys would otherwise outlive its own
revocation — revoke the compromised credential and the key it quietly
created keeps working. The whole subtree goes in one statement, so
there is no moment at which the parent is gone and a descendant still
authenticates.

The number of keys actually deleted (this one plus its descendants)
is returned in the `X-Revoked-Count` response header. The cascade
cannot leave the project: a key in another project is never reached,
whatever it claims as its creator.

Regenerating a key from the dashboard is deliberately NOT a cascade.
Rotating a credential is not a request to destroy everything it made,
so the descendants survive and their `created_by_key_id` becomes null.

## Response `204`

API key revoked.

## Other responses

- `400`: id is not a valid UUID.
- `401`: Missing or invalid API key.
- `403`: The API key authenticated, but its scope does not reach this operation. The problem body carries `required_scope`: the tier the operation needs. Re-mint the key at that scope (Settings, `POST /api/v1/api-keys`, or the `create_api_key` MCP tool) rather than retrying — the refusal is deterministic and a retry will be refused identically.
- `404`: API key not found in this project.
- `429`: Too many requests. The per-principal fixed-window rate limit has been exceeded. Retry after the number of seconds indicated by the `Retry-After` response header. The problem body's `code` is `RATE_LIMITED`. It names this limiter specifically, so a client can tell it apart from the application-level throttles that also answer 429 with their own codes and their own, much longer, `Retry-After` values (`TEST_PING_RATE_LIMITED`, `TOO_MANY_ATTEMPTS`). Back off globally on `RATE_LIMITED`; back off on the one operation for the others. The principal is the API key for a key-authenticated request and the USER for a browser session, so every tab one person has open shares one budget.

---

[API](https://skmtc.dev/lastping/apis/lastping-management-api.md) · [All operations](https://skmtc.dev/lastping/apis/lastping-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lastping/apis/lastping-management-api/revisions/bbc6eda91c46?raw)