---
title: "Revoke every credential (emergency)"
method: POST
path: "/credentials/revoke-all"
tags: ["Credentials"]
---

# Revoke every credential (emergency)

`POST /credentials/revoke-all`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/credentials/revoke-all`
- Auth: HTTP bearer

The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with "revoke all". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.

Person only: a dashboard session. The person's role must hold credentials:revoke_all. API keys, agent connection keys and agents are refused.

## Headers

- `Idempotency-Key` string

## Request body

- CredentialsRevokeAllCredentialsInput
  - `since` string, date-time, required
  - `suspend_function_ids` string[]
  - `confirm` 'revoke all', required

## Response `200`

Success

- object
  - `success` true, required
  - `data` CredentialsRevokeAllCredentialsResult, required
    - `api_keys_revoked` number, required
    - `connected_keys_revoked` number, required
    - `oauth_grants_revoked` number, required
    - `cli_logins_revoked` number
    - `functions_suspended` number, required
    - `org_function_key` 'rotated' | 'rotation_incomplete' | 'rotation_disabled' | 'none', required
    - `per_function_keys_to_rotate` string[], required
    - `per_function_rotation_queued` string[]

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)