Disable the calling API key

OpenAPI contract

Method

POST

Path

/api/v1/api-keys/self-disable

Security

automationKey (bearer)

Response status

204 400 401 403 404 429 500

Request and response schemas

JSON

{
  "requestBody": {},
  "responses": {
    "204": {
      "description": "Calling API key disabled",
      "content": {}
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "404": {
      "description": "Requested API key was not found",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

POST /api/v1/api-keys/self-disable accepts only an nfy_ automation key. It requires no scope and immediately disables the same key that authenticated the request. The successful response has no body.

Use this endpoint when an integration detects that its credential may be exposed. After the response, that key can no longer authenticate, so a repeated request with it is rejected. The account owner can inspect and re-enable the key later with a dashboard JWT and the update operation, unless the key was permanently revoked.

http

POST /api/v1/api-keys/self-disable
Authorization: Bearer <nfy_ key>