# Revoke an API key

Source: https://api-docs.magicdoor.com/api-reference/api-keys/revoke-api-key

Stops a key working and returns it with `revoked` set, so a screen can show when it died. You can only revoke a key you issued yourself. Requires the `api_keys:delete` permission.

`DELETE https://auth.magicdoor.com/company-portal/api-keys/{apiKeyId}`

**Authentication:** bearer token in the `Authorization` header, as `Bearer <token>`.

## Path parameters

- `apiKeyId` (string, required) — The key to revoke, as a Snowflake id in decimal-string form. Must be a positive whole number. Example: `1830472847398404096`.

## Example request

```bash
curl --request DELETE \
  --url 'https://auth.magicdoor.com/company-portal/api-keys/1830472847398404096' \
  --header 'Authorization: Bearer <token>'
```

## Responses

### 200 — The revoked key

- `id` (string) — This key's id, a Snowflake sent as a decimal string.
- `name` (string) — The label the issuer gave the key.
- `userId` (string) — The user the key acted as, which for a revocable key is always the caller.
- `permissions` (string[]) — What the key was allowed to do, as `resource:action` strings. Absent when the key was unscoped.
- `created` (string, date-time) — When the key was issued, in the company's timezone and with no offset.
- `expires` (string, date-time) — When the key would have stopped working on its own. Absent when it had no expiry.
- `lastUsed` (string, date-time) — When the key was last exchanged for an access token. Absent when it was never used.
- `revoked` (string, date-time) — When the key stopped working, in the company's timezone. Always present in this response.

```json
{
  "id": "1830472847398404096",
  "name": "Nightly rent-roll sync",
  "userId": "1824903117441335296",
  "permissions": [
    "properties:read",
    "units:read",
    "leases:read"
  ],
  "created": "2026-08-17T21:04:11",
  "expires": "2027-01-01T00:00:00",
  "lastUsed": "2026-08-17T23:15:02",
  "revoked": "2026-08-18T08:40:03"
}
```

### 401 — The access token is missing, expired, or invalid — or the key belongs to another user

### 403 — The caller does not hold the `api_keys:delete` permission

### 404 — No such key, or the key belongs to another company

```json
{
  "type": "https://httpstatuses.com/404",
  "title": "Not Found",
  "status": 404,
  "detail": "ApiKey not found.",
  "instance": "/company-portal/api-keys/1830472847398404096",
  "traceId": "0HN7GK9C2M4PQ",
  "entityType": "ApiKey",
  "entityId": "1830472847398404096"
}
```

> **Warning: You can see a colleague's keys but not revoke them**
>
> Revoking a key someone else issued returns `401`, even with `api_keys:delete`. To stop a departing employee's keys, deactivate the person instead — every key they issued stops at once, because each exchange re-checks the owner.

Revoking a key that is already revoked is harmless and does not move the revocation time. There is no way to un-revoke: issue a new key instead.