Revoke API Key
curl --request DELETE \
--url https://api.example.com/api/api-keys/{key_id} \
--header 'Authorization: <authorization>' \
--header 'X-Organization-Id: <x-organization-id>'import requests
url = "https://api.example.com/api/api-keys/{key_id}"
headers = {
"Authorization": "<authorization>",
"X-Organization-Id": "<x-organization-id>"
}
response = requests.delete(url, headers=headers)
print(response.text)const options = {
method: 'DELETE',
headers: {Authorization: '<authorization>', 'X-Organization-Id': '<x-organization-id>'}
};
fetch('https://api.example.com/api/api-keys/{key_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/api-keys/{key_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "DELETE",
CURLOPT_HTTPHEADER => [
"Authorization: <authorization>",
"X-Organization-Id: <x-organization-id>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/api-keys/{key_id}"
req, _ := http.NewRequest("DELETE", url, nil)
req.Header.Add("Authorization", "<authorization>")
req.Header.Add("X-Organization-Id", "<x-organization-id>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.delete("https://api.example.com/api/api-keys/{key_id}")
.header("Authorization", "<authorization>")
.header("X-Organization-Id", "<x-organization-id>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/api-keys/{key_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Delete.new(url)
request["Authorization"] = '<authorization>'
request["X-Organization-Id"] = '<x-organization-id>'
response = http.request(request)
puts response.read_body{
"success": true,
"message": "API key revoked successfully",
"data": {
"key_id": "apikey_a1b2c3d4e5f6",
"name": "Production API Key",
"role": "agent_manager",
"prefix": "bk_live_xxxx",
"client_id": "org_abc123",
"user_id": "user_def456",
"status": "revoked",
"created_at": "2024-01-15T10:30:00Z",
"last_used_at": "2024-01-15T14:45:00Z",
"expires_at": "2025-12-31T23:59:59Z"
}
}
API Keys
Revoke API Key
DELETE
/
api
/
api-keys
/
{key_id}
Revoke API Key
curl --request DELETE \
--url https://api.example.com/api/api-keys/{key_id} \
--header 'Authorization: <authorization>' \
--header 'X-Organization-Id: <x-organization-id>'import requests
url = "https://api.example.com/api/api-keys/{key_id}"
headers = {
"Authorization": "<authorization>",
"X-Organization-Id": "<x-organization-id>"
}
response = requests.delete(url, headers=headers)
print(response.text)const options = {
method: 'DELETE',
headers: {Authorization: '<authorization>', 'X-Organization-Id': '<x-organization-id>'}
};
fetch('https://api.example.com/api/api-keys/{key_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/api-keys/{key_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "DELETE",
CURLOPT_HTTPHEADER => [
"Authorization: <authorization>",
"X-Organization-Id: <x-organization-id>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/api-keys/{key_id}"
req, _ := http.NewRequest("DELETE", url, nil)
req.Header.Add("Authorization", "<authorization>")
req.Header.Add("X-Organization-Id", "<x-organization-id>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.delete("https://api.example.com/api/api-keys/{key_id}")
.header("Authorization", "<authorization>")
.header("X-Organization-Id", "<x-organization-id>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/api-keys/{key_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Delete.new(url)
request["Authorization"] = '<authorization>'
request["X-Organization-Id"] = '<x-organization-id>'
response = http.request(request)
puts response.read_body{
"success": true,
"message": "API key revoked successfully",
"data": {
"key_id": "apikey_a1b2c3d4e5f6",
"name": "Production API Key",
"role": "agent_manager",
"prefix": "bk_live_xxxx",
"client_id": "org_abc123",
"user_id": "user_def456",
"status": "revoked",
"created_at": "2024-01-15T10:30:00Z",
"last_used_at": "2024-01-15T14:45:00Z",
"expires_at": "2025-12-31T23:59:59Z"
}
}
Revoke an API key, preventing it from being used for future requests. Revoked keys remain in the list but with
status: revoked.
Headers
string
required
Bearer token from Cognito authentication (JWT).
string
required
The organization ID.
Path Parameters
string
required
The unique identifier of the API key (format:
apikey_[a-f0-9]{12}).Permissions
- Only
adminandagent_managerroles can revoke API keys. - You cannot revoke a key with a higher role than your own.
Response
boolean
Indicates if the request was successful.
string
Human-readable success message.
object
The revoked API key object.
Show properties
Show properties
string
Unique key identifier.
string
The name of the API key.
string
The role assigned to this key.
string
The first 12 characters of the key.
string
The organization ID this key belongs to.
string
The user ID who created this key.
string
The key status (
revoked).string
ISO 8601 timestamp of creation.
string
ISO 8601 timestamp of last usage.
string
ISO 8601 timestamp of expiration.
{
"success": true,
"message": "API key revoked successfully",
"data": {
"key_id": "apikey_a1b2c3d4e5f6",
"name": "Production API Key",
"role": "agent_manager",
"prefix": "bk_live_xxxx",
"client_id": "org_abc123",
"user_id": "user_def456",
"status": "revoked",
"created_at": "2024-01-15T10:30:00Z",
"last_used_at": "2024-01-15T14:45:00Z",
"expires_at": "2025-12-31T23:59:59Z"
}
}
Error Responses
403 Forbidden
403 Forbidden
Returned when the caller does not have permission to revoke API keys or is trying to revoke a key with a higher role than their own.
{
"detail": "Only admins and agent managers can revoke API keys"
}
404 Not Found
404 Not Found
Returned when the API key does not exist or does not belong to the current organization.
{
"detail": "API key not found or does not belong to this organization"
}
⌘I