ORory
ApiKeys

Revoke Issued API Key

Immediately revokes an issued API key. Once revoked, the key can no longer be used for authentication. This operation is irreversible. Revoked keys are retained for audit purposes.

POST /v2alpha1/admin/issuedApiKeys/01HQZX9VYQKJB8XQZQXQZQXQXQ:revoke
{
  "reason": "REVOCATION_REASON_KEY_COMPROMISE"
}
post/v2alpha1/admin/issuedApiKeys/{key_id}:revoke

Request

  • Base URL
    https://your-project.projects.oryapis.com
  • URL
    https://your-project.projects.oryapis.com/v2alpha1/admin/issuedApiKeys/{key_id}:revoke
  • Auth
    none declared

Path parameters

key_idstring required

UUID of the issued key (REQUIRED)

Request body

descriptionstring

Optional free-text explanation. Only allowed when reason is PRIVILEGE_WITHDRAWN.

reason'REVOCATION_REASON_UNSPECIFIED' | 'REVOCATION_REASON_KEY_COMPROMISE' | 'REVOCATION_REASON_AFFILIATION_CHANGED' | 'REVOCATION_REASON_SUPERSEDED' | 'REVOCATION_REASON_PRIVILEGE_WITHDRAWN'

RevocationReason provides structured revocation reasons inspired by RFC 5280. Used in both admin and self-revocation flows.

  • REVOCATION_REASON_UNSPECIFIED: Default zero value. Use a specific reason; UNSPECIFIED is rejected by admin and self-revocation endpoints.
  • REVOCATION_REASON_KEY_COMPROMISE: The key was leaked or believed to be in the hands of an unauthorized party.
  • REVOCATION_REASON_AFFILIATION_CHANGED: The owning actor's relationship with the issuer changed (e.g., role change, departure).
  • REVOCATION_REASON_SUPERSEDED: A new key has replaced this one as part of a rotation.
  • REVOCATION_REASON_PRIVILEGE_WITHDRAWN: Admin-only. The actor's privilege to use this key was withdrawn by an operator. Self-revocation requests using this reason are rejected with InvalidArgument. Pair with description on the admin revoke requests to record the operator-supplied justification.

Response

A successful response.

object required

Changes

No recorded changes to this operation across all 1 revision of this API.