Revoke an API key (POST variant)
Same effect as DELETE /v1/api-keys/:id, but returns the updated entity. Use when the caller needs the fresh status = "revoked" body without a second GET.
Authorization
bearer In: header
Path Parameters
Response Body
application/json
curl -X POST "https://<api-host>/v1/api-keys/string/revoke"{
"data": {
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"tenantId": "f97df110-f4de-492e-8849-4a6af68026b0",
"livemode": true,
"owner": {
"type": "merchant",
"merchantId": "c3073b9d-edd0-49f2-a28d-b7ded8ff9a8b",
"tenantId": "f97df110-f4de-492e-8849-4a6af68026b0"
},
"environment": "test",
"keyType": "public",
"inboundFormat": "miracle_native",
"publicKey": "string",
"name": "string",
"status": "active",
"permissions": [
"string"
],
"ipAllowlist": [
"string"
],
"expiresAt": "string",
"createdAt": "string",
"updatedAt": "string",
"deletedAt": null,
"revokedAt": "string",
"rotatedFromKeyId": "398ea6c9-3802-4188-a0cb-054a865227fd",
"createdBy": "25a02396-1048-48f9-bf93-102d2fb7895e",
"createdByType": "user"
}
}Revoke an API key (DELETE variant)
Revokes an active API key. Once revoked, the key cannot authenticate further requests. Revocation is permanent — issue a new key if access is needed again. Soft delete: the record is preserved for audit.
Rotate an API key
Creates a NEW API key inheriting the source key's scope, permissions and IP allowlist. The source key stays active for `graceHours` (default 24h) to allow downstream services to migrate. The new plaintext is returned ONCE. Repeating the request with the same `Idempotency-Key` answers 409 `API_KEY_ALREADY_ISSUED` with the successor id in `instance`.