Revoke an API key

OpenAPI contract

Method

DELETE

Path

/api/v1/api-keys/{id}

Security

jwtBearer (bearer)

Response status

204 400 401 403 404 429 500

Request and response schemas

JSON

{
  "requestBody": {},
  "responses": {
    "204": {
      "description": "API key revoked",
      "content": {}
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "404": {
      "description": "Requested API key was not found",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

DELETE /api/v1/api-keys/{id} is JWT-only. Supply the UUID id of a key owned by the authenticated user. The operation has no response body and is safe to repeat for an already revoked owned key.

An nfy_ automation key cannot revoke keys. A key outside the account is reported as not found; missing or invalid JWT authentication is rejected. Remove the revoked secret from every CI store and local environment.

http

DELETE /api/v1/api-keys/{id}
Authorization: Bearer <access token>