> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbutter.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke API Key

Revoke an API key, preventing it from being used for future requests. Revoked keys remain in the list but with `status: revoked`.

### Headers

<ParamField header="Authorization" type="string" required>
  Bearer token from Cognito authentication (JWT).
</ParamField>

<ParamField header="X-Organization-Id" type="string" required>
  The organization ID.
</ParamField>

### Path Parameters

<ParamField path="key_id" type="string" required>
  The unique identifier of the API key (format: `apikey_[a-f0-9]{12}`).
</ParamField>

### Permissions

* Only `admin` and `agent_manager` roles can revoke API keys.
* You cannot revoke a key with a higher role than your own.

### Response

<ResponseField name="success" type="boolean">
  Indicates if the request was successful.
</ResponseField>

<ResponseField name="message" type="string">
  Human-readable success message.
</ResponseField>

<ResponseField name="data" type="object">
  The revoked API key object.

  <Expandable title="properties">
    <ResponseField name="key_id" type="string">
      Unique key identifier.
    </ResponseField>

    <ResponseField name="name" type="string">
      The name of the API key.
    </ResponseField>

    <ResponseField name="role" type="string">
      The role assigned to this key.
    </ResponseField>

    <ResponseField name="prefix" type="string">
      The first 12 characters of the key.
    </ResponseField>

    <ResponseField name="client_id" type="string">
      The organization ID this key belongs to.
    </ResponseField>

    <ResponseField name="user_id" type="string">
      The user ID who created this key.
    </ResponseField>

    <ResponseField name="status" type="string">
      The key status (`revoked`).
    </ResponseField>

    <ResponseField name="created_at" type="string">
      ISO 8601 timestamp of creation.
    </ResponseField>

    <ResponseField name="last_used_at" type="string">
      ISO 8601 timestamp of last usage.
    </ResponseField>

    <ResponseField name="expires_at" type="string">
      ISO 8601 timestamp of expiration.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseExample>
  ```json Response theme={null}
  {
    "success": true,
    "message": "API key revoked successfully",
    "data": {
      "key_id": "apikey_a1b2c3d4e5f6",
      "name": "Production API Key",
      "role": "agent_manager",
      "prefix": "bk_live_xxxx",
      "client_id": "org_abc123",
      "user_id": "user_def456",
      "status": "revoked",
      "created_at": "2024-01-15T10:30:00Z",
      "last_used_at": "2024-01-15T14:45:00Z",
      "expires_at": "2025-12-31T23:59:59Z"
    }
  }
  ```
</ResponseExample>

### Error Responses

<Accordion title="403 Forbidden">
  Returned when the caller does not have permission to revoke API keys or is trying to revoke a key with a higher role than their own.

  ```json theme={null}
  {
    "detail": "Only admins and agent managers can revoke API keys"
  }
  ```
</Accordion>

<Accordion title="404 Not Found">
  Returned when the API key does not exist or does not belong to the current organization.

  ```json theme={null}
  {
    "detail": "API key not found or does not belong to this organization"
  }
  ```
</Accordion>