Revoke an API key
DELETE/api-keys/:appId
Revokes the key identified by appId.
Access tokens already issued from the key stay valid until they expire; no new tokens can be issued. A revoked key cannot be restored and the record remains in the list with isRevoked set to true.
Required role: superadmin or admin.
Request
Responses
- 204
- 401
- 403
- 404
- 410
- 500
The key was revoked.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).
No key has this appId.
The key has already been revoked.
Unexpected error while revoking.