ORory
ApiKeys

Revoke API Key (self-service)

Proof-of-possession variant of revocation. The Self* prefix on the request/response messages disambiguates from the admin variants (AdminRevokeIssuedApiKey / AdminRevokeImportedApiKey).

Allows an API key holder to revoke their own key. The caller must provide the full API key secret as proof of possession. Supports issued API keys and imported keys. JWT and macaroon tokens cannot be self-revoked (they are stateless).

The PRIVILEGE_WITHDRAWN reason is not allowed for self-revocation (admin-only).

POST /v2alpha1/apiKeys:selfRevoke
{
  "credential": "sk_live_abc123...",
  "reason": "REVOCATION_REASON_KEY_COMPROMISE"
}
post/v2alpha1/apiKeys:selfRevoke

Request

  • Base URL
    https://your-project.projects.oryapis.com
  • URL
    https://your-project.projects.oryapis.com/v2alpha1/apiKeys:selfRevoke
  • Auth
    none declared

Request body

credentialstring
reason'REVOCATION_REASON_UNSPECIFIED' | 'REVOCATION_REASON_KEY_COMPROMISE' | 'REVOCATION_REASON_AFFILIATION_CHANGED' | 'REVOCATION_REASON_SUPERSEDED' | 'REVOCATION_REASON_PRIVILEGE_WITHDRAWN'

RevocationReason provides structured revocation reasons inspired by RFC 5280. Used in both admin and self-revocation flows.

  • REVOCATION_REASON_UNSPECIFIED: Default zero value. Use a specific reason; UNSPECIFIED is rejected by admin and self-revocation endpoints.
  • REVOCATION_REASON_KEY_COMPROMISE: The key was leaked or believed to be in the hands of an unauthorized party.
  • REVOCATION_REASON_AFFILIATION_CHANGED: The owning actor's relationship with the issuer changed (e.g., role change, departure).
  • REVOCATION_REASON_SUPERSEDED: A new key has replaced this one as part of a rotation.
  • REVOCATION_REASON_PRIVILEGE_WITHDRAWN: Admin-only. The actor's privilege to use this key was withdrawn by an operator. Self-revocation requests using this reason are rejected with InvalidArgument. Pair with description on the admin revoke requests to record the operator-supplied justification.

Response

A successful response.

SelfRevokeApiKeyResponse required

SelfRevokeApiKeyResponse is returned on successful self-revocation.

Empty on success

Changes

No recorded changes to this operation across all 1 revision of this API.