---
title: "Publicly revoke leaked Composio API keys"
method: POST
path: "/api/v3.1/api_key_revocation"
tags: ["API Keys"]
---

# Publicly revoke leaked Composio API keys

`POST /api/v3.1/api_key_revocation`

Public endpoint for reporting and revoking Composio API keys that have been leaked (e.g. via the GitHub Secret Scanning Partner Program, third-party scanners, or self-reported leaks). Accepts project (ak_*), user (uak_*), and org (oak_*) keys in a single batch. Matched keys are revoked or soft-deleted. The response shape is constant regardless of whether any submitted key matched, so callers cannot use this endpoint to probe key existence. IP-rate-limited via the shared `ipRateLimitMiddleware` (same Redis-backed pattern used by the public install endpoint): per-IP and global tiers, fail-closed on Redis errors, returns 429 on hit.

## Request body

- object
  - `api_keys` string[], required — Composio API keys to revoke. Accepts project (ak_*), user (uak_*), and org (oak_*) keys. Each batch is capped at 100 entries.

## Response `200`

Revocation request received

- object
  - `received` boolean, required — Always true when the request body is valid. The response intentionally does not reveal whether any submitted key matched a record.

## Other responses

- `400` — Malformed payload
- `429` — Too many requests

---

[API](https://skmtc.net/composiohq/apis/composio-platform-api-v3-1.md) · [All operations](https://skmtc.net/composiohq/apis/composio-platform-api-v3-1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/composiohq/composio-platform-api-v3-1/revisions/4239836857f8/schema)