---
title: "Evict an API key from the in-memory cache (server-to-server)"
method: POST
path: "/v1/internal/evict"
tags: ["System"]
---

# Evict an API key from the in-memory cache (server-to-server)

`POST /v1/internal/evict`

## Request

- Base URL: `https://api.phototology.com`
- URL: `https://api.phototology.com/v1/internal/evict`
- Auth: API key in header `x-internal-secret`

Internal endpoint used by Phototology dashboard server actions and webhook hooks to evict revoked API keys from the Express service's LRU cache immediately, rather than waiting for the 5-minute TTL. Provide either `userId` (evicts all keys for that user) or `keyHash` (evicts one key). Auth is via `x-internal-secret` header.

## Request body

- object
  - `userId` string: Evict all keys for this user. Provide `userId` OR `keyHash`, not both.
  - `keyHash` string: SHA-256 hash of a single key to evict.

## Response `200`

Eviction completed.

- object
  - `ok` true, required

## Other responses

- `400`: Neither `userId` nor `keyHash` was provided.
- `401`: Missing or invalid `x-internal-secret` header.

---

[API](https://skmtc.dev/phototology/apis/phototology-api.md) · [All operations](https://skmtc.dev/phototology/apis/phototology-api/llms.txt) · [OpenAPI document](https://skmtc.dev/phototology/apis/phototology-api/revisions/3cb0fc707b63?raw)