---
title: "Revoke a project credential (owner-only)"
method: DELETE
path: "/projects/v1/{project_id}/credentials/{credential_id}"
tags: ["Projects"]
---

# Revoke a project credential (owner-only)

`DELETE /projects/v1/{project_id}/credentials/{credential_id}`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/{project_id}/credentials/{credential_id}`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Revokes one credential immediately. Scoped by project as well as id, so a guessed credential_id cannot reach another project's credential. Revoking frees its name for reuse. Other live credentials are unaffected.

## Path parameters

- `project_id` string, required
- `credential_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `reason` string

## Response `200`

Revoked

- object
  - `credential_id` string
  - `project_id` string
  - `kind` 'anon' | 'service'
  - `name` string
  - `created_at` string, date-time
  - `last_used_at` string, date-time, nullable
  - `expires_at` string, date-time, nullable
  - `revoked_at` string, date-time, nullable
  - `revoked_reason` string, nullable
  - `replacement_of` string, nullable

## Other responses

- `403`: Not an owner of the project's org, or step-up required
- `404`: No such live credential on this project (CREDENTIAL_NOT_FOUND)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)