Revoke an API key

Stops a key working and returns it with revoked set, so a screen can show when it died. You can only revoke a key you issued yourself. Requires the api_keys:delete permission.

Authorization

Authorizationstringrequired

Bearer token — Send your API token in the Authorization header as Bearer <token>. Requests without a valid token are rejected with 401 Unauthorized.

Path parameters

apiKeyIdstringrequired

The key to revoke, as a Snowflake id in decimal-string form. Must be a positive whole number.

example: 1830472847398404096

Response

200 · The revoked key

idstring

This key's id, a Snowflake sent as a decimal string.

namestring

The label the issuer gave the key.

userIdstring

The user the key acted as, which for a revocable key is always the caller.

permissionsstring[]

What the key was allowed to do, as resource:action strings. Absent when the key was unscoped.

createdstring · date-time

When the key was issued, in the company's timezone and with no offset.

expiresstring · date-time

When the key would have stopped working on its own. Absent when it had no expiry.

lastUsedstring · date-time

When the key was last exchanged for an access token. Absent when it was never used.

revokedstring · date-time

When the key stopped working, in the company's timezone. Always present in this response.

401 · The access token is missing, expired, or invalid — or the key belongs to another user

403 · The caller does not hold the `api_keys:delete` permission

404 · No such key, or the key belongs to another company

You can see a colleague's keys but not revoke them

Revoking a key someone else issued returns 401, even with api_keys:delete. To stop a departing employee's keys, deactivate the person instead — every key they issued stops at once, because each exchange re-checks the owner.

Revoking a key that is already revoked is harmless and does not move the revocation time. There is no way to un-revoke: issue a new key instead.