Revoke API Key

Soft-revoke an API key (sets revoked_at, preserves the row for audit)

DELETE /v1/organization/api-keys/{id}

Revoke API Key

cURL

curl --request DELETE \
  --url https://api.signa.so/v1/organization/api-keys/{id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.signa.so/v1/organization/api-keys/{id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.delete(url, headers=headers)

print(response.text)

const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.signa.so/v1/organization/api-keys/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.signa.so/v1/organization/api-keys/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "DELETE",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.signa.so/v1/organization/api-keys/{id}"

	req, _ := http.NewRequest("DELETE", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.delete("https://api.signa.so/v1/organization/api-keys/{id}")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.signa.so/v1/organization/api-keys/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Delete.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "key_Mc2eF6gH",
  "object": "api_key",
  "deleted": true,
  "request_id": "req_zS5jK1lM"
}

Overview

Revokes an API key by setting its revoked_at timestamp. The key record is preserved so audit logs and historical usage records remain valid. Once revoked, requests using the key return 401 unauthorized immediately.

System keys cannot be revoked. Requires the api-keys:manage scope and an Idempotency-Key header; see Idempotency.

Path Parameters

id · string · required

API key ID (key_...).

Response

id · string

Echo of the revoked API key ID.

object · string

Always api_key.

deleted · boolean

Always true on success.

request_id · string

Unique request identifier for support and debugging.

{
  "id": "key_Mc2eF6gH",
  "object": "api_key",
  "deleted": true,
  "request_id": "req_zS5jK1lM"
}

Code Examples

cURL

curl -X DELETE "https://api.signa.so/v1/organization/api-keys/key_Mc2eF6gH" \
  -H "Authorization: Bearer sig_YOUR_KEY" \
  -H "Idempotency-Key: revoke-key-Mc2eF6gH-2026-06-12"

import { Signa } from "@signa-so/sdk";

const signa = new Signa({ api_key: process.env.SIGNA_API_KEY });

await signa.organization.apiKeys.revoke("key_Mc2eF6gH");

Revocation is irreversible. To roll a key without downtime, use Rotate API Key: the old key remains valid for a 24-hour grace period.

Errors

Status	Type	Description
400	validation_error	Invalid API key ID or missing Idempotency-Key header
401	unauthorized	Missing or invalid API key
403	forbidden	API key lacks api-keys:manage or target is a system key
404	not_found	API key does not exist or belongs to another org

Related Endpoints

• Rotate API Key, graceful key rotation
• List API Keys