---
title: "Revoke an API key by id (idempotent); ends its live session and deletes its browser profile"
method: POST
path: "/v1/account/api-keys/{id}/revoke"
---

# Revoke an API key by id (idempotent); ends its live session and deletes its browser profile

`POST /v1/account/api-keys/{id}/revoke`

## Request

- Base URL: `https://api.roveapi.com`
- URL: `https://api.roveapi.com/v1/account/api-keys/{id}/revoke`
- Auth: API key in cookie `rove_session`

## Path parameters

- `id` string, uuid, required

## Response `200`

Successful response (Cache-Control: no-store)

- object
  - `id` string, uuid, required
  - `name` string, nullable, required
  - `environment` 'live' | 'test', required
  - `key_id_fingerprint` string, required: The viewer's API key ID: first 8 hex of SHA-256 of the key id.
  - `created_at` string, date-time, required
  - `last_used_at` string, date-time, nullable, required
  - `revoked_at` string, date-time, nullable, required
  - `kind` 'key' | 'oauth', required: 'oauth' for the dedicated key of a connected app's grant; such a key has no token and cannot be rotated.
  - `connected_app` object, nullable, required: null for every kind 'key' row.
    - `grant_id` string, uuid, required
    - `client_name` string, required: The app's display name: its asserted name, else its redirect host, else 'an app on this computer'. Not verified by Rove.
    - `grant_active` boolean, required

## Other responses

- `401`: RFC 7807 owner-session-required: sign in
- `403`: RFC 7807 owner-origin-refused (mutations only)
- `404`: RFC 7807 key-not-found: re-read the key list
- `503`: RFC 7807 account-service-unavailable; Retry-After: 30

---

[API](https://skmtc.dev/roveapi/apis/rove-api.md) · [All operations](https://skmtc.dev/roveapi/apis/rove-api/llms.txt) · [OpenAPI document](https://skmtc.dev/roveapi/apis/rove-api/revisions/0e5d69bde586?raw)