Api keys
Revoke an API key (DELETE variant)
Revokes an active API key. Once revoked, the key cannot authenticate further requests. Revocation is permanent — issue a new key if access is needed again. Soft delete: the record is preserved for audit.
curl -X DELETE "https://<api-host>/v1/api-keys/string"Empty
Empty
Empty
List permissions grantable on a new API key
Returns the permission codes a key of `ownerType` may carry when the caller issues it: the owner-layer set (merchant keys: merchant layer; tenant keys: operator layer) intersected with the caller's own permissions. A create request whose `permissions` stay inside this list passes both permission checks.
Revoke an API key (POST variant)
Same effect as `DELETE /v1/api-keys/:id`, but returns the updated entity. Use when the caller needs the fresh `status = "revoked"` body without a second GET.