Revoke an organization API key
Requires key:manage and a creator who is still an organization owner or admin. The target must belong to the authenticated organization; missing and foreign keys both return 404. Revoking a recorded parent or transitive ancestor returns 403 key_ancestor_revocation_forbidden, including through revoked ancestors. Revoking an already revoked non-ancestor key succeeds without another policy event. Subsequent authentication with the revoked key is refused. Free.
Requires key:manage and a creator who is still an organization owner or admin. The target must belong to the authenticated organization; missing and foreign keys both return 404. Revoking a recorded parent or transitive ancestor returns 403 key_ancestor_revocation_forbidden, including through revoked ancestors. Revoking an already revoked non-ancestor key succeeds without another policy event. Subsequent authentication with the revoked key is refused.
Free.
Authorization
bearerAuth In: header
Path Parameters
Organization API key to revoke
uuidHeader Parameters
Required for writes. Reusing this key with the same input replays the original response.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v1/keys/497f6eca-6276-4993-bfeb-53cbbbba6f08/revoke" \ -H "Idempotency-Key: string" \ -H "Content-Type: application/json" \ -d '{ "keyId": "468bcefd-6536-4844-8249-aff3ecb2ef7b" }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "revoked": true}Create an API key and reveal its secret once POST
Requires an explicitly delegated key:manage capability whose creator is still an organization owner or admin. Callers carrying any spend bounds cannot create keys: delegation must not multiply a rolling budget. An unbounded management key may grant requested scopes, including priced scopes with finite per-request and rolling-budget bounds. Child expiry cannot exceed the caller's expiry. A restricted caller must grant an explicit subset of its Operation allowlist and cannot delegate key:manage. Null allowedOperations permits every Operation allowed by scopes; [] permits none. The secret is returned only on initial success and is never persisted in the idempotency receipt. Replays return 409; revoke the created key and use a new request if the secret was lost. Free.
List per-item enrichment outcomes GET
Lists child enrichments in stable target order with lifecycle and outcome as separate fields. Outputs are opt-in via `include=output`, and `ref` echoes the caller's per-target correlation key. Free.