Revoke API key
api_keys
Revoke API key
Revoke a key (simple soft-delete): status=revoked, deleted_at set. Verify rejects it from the next request (cache invalidated). Irreversible: a revoked key never re-activates; issue a fresh one. Idempotent: re-deleting → already_deleted.
Contract:
- MCP tool
delete_api_key, registry packagemcp.id/api_keys, mountid.access. - Operation
delete, response envelopedelete_simple. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.
DELETE
Revoke API key
Authorizations
Access token issued by gtm.service.id. Its access_identity claim carries team_sid, actor_sid and actor_type, and that team scope is authoritative.
Team scope for tokens that do not carry one. Ignored when the token already names a team.
Path Parameters
Path segment {sid}.
Required string length:
18Pattern:
^id_ak_