---
title: "Disable the global API key"
method: POST
path: "/v1/account/global_api_key:disable"
tags: ["GlobalAPIKeyService", "API Keys"]
---

# Disable the global API key

`POST /v1/account/global_api_key:disable`

Disables the global API key. While disabled, presenting its token fails authentication on every endpoint; the key is retained. Idempotent.

## Response `200`

OK

- APIKey — An API key. Every key belongs to exactly one workspace and is managed via the workspace-scoped API key routes. The only exception is the system-managed global account key, which spans all workspaces and is managed via the account global_api_key routes.
  - `metadata` AccountResourceMetadata, required — AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.
    - `id` string, required — Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")
    - `accountId` string, required — Account this resource belongs to for multi-tenant isolation (prefixed ULID)
    - `name` string, required — Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool") Required for resources that users interact with directly
    - `externalId` string — External ID for the resource (e.g., a workflow ID from an external system)
    - `labels` object — Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"}
    - `profileId` string, required
    - `createdAt` string, date-time
  - `spec` APIKeySpec, required — Configuration for an API key.
    - `token` string — The bearer token used to authenticate as this API key. Returned only on creation and rotation; subsequent reads omit this field.
    - `description` string — Free-form description of what this API key is used for.
    - `permissions` string[] — Scopes granted to this key. Each entry is a colon-separated resource:verb string (e.g. "objectives:manage"). Resources: agents, objectives, tools, memory, api_keys, workspaces, widgets, widget_sessions, secrets, account. Verbs: read and manage, where manage implies read — a stored scope set is normalized to drop "x:read" when "x:manage" is present. The secrets and account resources support only manage. "*" is an explicit full-access grant. Scopes are deny-by-default: a key with an empty list can call only scope-free endpoints. Full access is always an explicit "*" grant.
    - `system` boolean — True when this key is managed by the system (i.e. the auto-provisioned global account key). System keys cannot be deleted but can be rotated.
  - `info` APIKeyInfo
    - `createdBy` Profile — A profile identifies a user or non-human principal (such as an API key) at the account level. Profiles are account-scoped and can be granted access to multiple workspaces.
      - `metadata` AccountResourceMetadata, required — AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.
        - `id` string, required — Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")
        - `accountId` string, required — Account this resource belongs to for multi-tenant isolation (prefixed ULID)
        - `name` string, required — Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool") Required for resources that users interact with directly
        - `externalId` string — External ID for the resource (e.g., a workflow ID from an external system)
        - `labels` object — Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"}
        - `profileId` string, required
        - `createdAt` string, date-time
      - `spec` ProfileSpec, required — Configuration for a profile.
        - `email` string — Email address of the profile. Required and unique within an account for user profiles.
        - `name` string — Display name (e.g., "Bobby Tables").
        - `type` 'PROFILE_TYPE_UNSPECIFIED' | 'PROFILE_TYPE_USER' | 'PROFILE_TYPE_API_KEY' | 'PROFILE_TYPE_SYSTEM', enum, required — Whether this profile represents a human user, an API key, or a system principal.
  - `state` 'STATE_UNSPECIFIED' | 'STATE_ENABLED' | 'STATE_DISABLED', enum, required — The current lifecycle state of the API key. Output only. Keys are created STATE_ENABLED; use the :disable and :enable actions to transition between states.

## Other responses

- `default` — Default error response

---

[API](https://skmtc.net/cadenya/apis/cadenya-api.md) · [All operations](https://skmtc.net/cadenya/apis/cadenya-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cadenya/cadenya-api/revisions/ac1a7f084068/schema)