Skip to content
Seismic Orchestration

DELETE /auth/api-keys/{id}

Revoke an API key. Effective immediately. In-flight requests using the key get 401 ApiKeyRevoked on the next hit. The row is preserved with revoked_at set so audit trails stay readable.

Permission model: org owner and admin can revoke any key in the org. Everyone else (member, viewer) can only revoke keys they minted themselves, useful for "I think this leaked, kill it now" automation where a key revokes itself. Pre-check the can_revoke flag on each row of GET /auth/api-keys to avoid the round-trip.

Response 204: no body.

Errors:

  • 404 ApiKeyNotFound: unknown key id (or belongs to a different org).
  • 403 ApiKeyRevokeForbidden: caller is an org member but is neither owner/admin nor the key's creator.
  • 409 AlreadyRevoked: the key is already revoked. Idempotent for the common retry case, but explicit so callers can distinguish "I just revoked it" from "it was already revoked yesterday".

Example

curl -X DELETE "$SEISMIC_ORCHESTRATION_URL/v0/auth/api-keys/k_2f10…" \
  -H "Api-Key: $SEISMIC_ORCHESTRATION_API_KEY"