Get It Done

Revoke an API key

DELETE/v1/api-keys/{key_id}

Revokes an API key (either generation) — org-scoped; an id from another organization or an unknown id answers 404 `resource_not_found` (no cross-org existence oracle). A key revoking ITSELF is allowed: the credential is only checked at the top of the request, before the revoke runs. DELETE is naturally idempotent by HTTP semantics — this route does not use the Idempotency-Key ledger.

Required scopes

api-keys:manage

Availability

All plans

Quota cost

1 API call

Idempotency

Not applicable

Request

Path parameters

Field	Type	Description
`key_id`required	string

Response 200

The key was revoked.

Fields

Field	Type	Description
`id`required	string	The id of the revoked key.
`legacy`required	boolean	True when the revoked key was a legacy row (soft-revoked); false for a plugin key (deleted).

▸ Raw response schema

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The id of the revoked key."
    },
    "legacy": {
      "type": "boolean",
      "description": "True when the revoked key was a legacy row (soft-revoked); false for a plugin key (deleted)."
    }
  },
  "required": [
    "id",
    "legacy"
  ],
  "additionalProperties": false,
  "description": "Confirmation that a key was revoked and can no longer authenticate."
}

Example request

curl

curl -X DELETE https://app.nowgetitdone.com/v1/api-keys/id_123 \
  -H "Authorization: Bearer gid_YOUR_API_KEY"