---
title: "Revoke an API key"
method: DELETE
path: "/api-keys/{apiKeyId}"
tags: ["API Keys"]
---

# Revoke an API key

`DELETE /api-keys/{apiKeyId}`

Permanently revokes an API key while retaining reveal-safe lifecycle and audit metadata. Requires api_keys:write and a live admin/owner membership. Repeating the request is safe.

## Path parameters

- `apiKeyId` string, required — Stable API key identifier.

## Response `200`

Revoked API key.

- ApiKeyResponse — API key metadata response.
  - `data` object, required — API key data.
    - `key` ApiKey, required — Reveal-safe API key metadata. The secret is only returned by issue and rotate responses.
      - `id` string, required — Stable API key identifier.
      - `key_prefix` string, required — Non-secret prefix for operator recognition.
      - `name` string, nullable, required — Optional operator-facing key label.
      - `scopes` string[], required — Exact scopes granted to the key.
      - `status` 'active' | 'disabled' | 'revoked', required — Credential lifecycle status.
      - `subject` ApiKeySubject, required — Workspace identity the credential acts as.
        - `display_name` string, nullable, required — Current subject display name.
        - `principal_type` 'agent' | 'user', required — Subject principal type.
        - `workspace_membership_id` string, required — Subject workspace membership identifier.

## Other responses

- `400` — Bad request.
- `401` — Missing or invalid API key.
- `403` — Forbidden.
- `404` — Not found.
- `409` — Conflict.
- `429` — Rate limit or quota exceeded.
- `500` — Internal server error.

---

[API](https://skmtc.net/ando/apis/ando-public-api.md) · [All operations](https://skmtc.net/ando/apis/ando-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ando/ando-public-api/revisions/0a94056fba48/schema)