Revoke a workspace API key

Deactivates a retained key using the existing manual-revocation lifecycle; metadata, audit history, accounts and actors remain. Requires current workspace API access management permission. Both management modes and all target scopes are supported; stack-scoped callers cannot manage the workspace. Missing/foreign keys return 404. Repeated unconditional deletion of a retained deactivated key returns 204 without changing its reason/time or emitting another lifecycle audit/event. Optional If-Match uses the current metadata GET validator, including last-used time. A stale conditional retry returns 412. Self-revocation completes this response but later authentication fails.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
string
required
^api_[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$

Public id that is created from the type prefix of the corresponding resource and its UUID. I.e : For an API key, a valid value would be : api_0197c8f2-5a6b-7cde-8f12-3456789abcde

Headers
string

Optional precondition. Send the quoted ETag from a GET of this resource. The mutation only runs if a strong tag matches the current representation, checked under the write lock. A comma-separated list is allowed; '*' requires an existing representation. Weak tags never match. Omit this header for an unconditional write. For an action, use the ETag from GET of the target resource, without the action suffix. A stale tag returns 412; read the current state before retrying.

Responses

Language
Credentials
Bearer
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
*/*
application/problem+json