Skip to content
CantoraAPI documentation
POST
/v1/organizations/{organizationId}/service-principals/{principalId}/api-keys/{apiKeyId}/revoke

Revoke an API Key for an Organization-scoped ServicePrincipal

Permanently revoke one credential while preserving its safe metadata.

Authentication

Send an API key as a Bearer token in the Authorization header.

Parameters

NameLocationRequiredDescription
organizationIdpathYes
The Organization to address.
stringA Cantora Organization identifier, prefixed with `org_`.
  • maximum length 64
  • pattern ^org_[\s\S]+$
principalIdpathYes
The Principal to address.
stringA Cantora Principal identifier, prefixed with `principal_`.
  • maximum length 64
  • pattern ^principal_[\s\S]+$
apiKeyIdpathYes
The API Key to address.
stringA Cantora API key identifier, prefixed with `apikey_`.
  • maximum length 64
  • pattern ^apikey_[\s\S]+$

Responses

200ApiKeyMetadata
application/json
ApiKeyMetadataEncoded
401Unauthorized
application/json
UnauthorizedEncoded
403Forbidden
application/json
ForbiddenEncoded
404NotFound
application/json
NotFoundEncoded

Reusable schemas

ApiKeyMetadataEncoded

object
  • unknown properties allowed false
apiKeyIdrequired
stringThe identifier of the issued API key.
  • maximum length 64
  • pattern ^apikey_[\s\S]+$
principalIdrequired
stringThe Principal identifier.
  • maximum length 64
  • pattern ^principal_[\s\S]+$
creationIdempotencyKeyrequired
The caller-chosen issuance key that identifies this committed credential.
Any of
IdempotencyKey
null
namerequired
stringThe human-readable resource name.
displayPrefixrequired
stringThe non-secret leading characters used to distinguish this credential.
createdByPrincipalIdrequired
stringThe Principal that created this immutable record.
  • maximum length 64
  • pattern ^principal_[\s\S]+$
createdAtrequired
stringWhen the resource was created, in UTC.
  • format date-time
expiresAtrequired
stringWhen the resource expires, in UTC, or null when it does not expire.
  • format date-time
lastUsedAtrequired
Approximately when this credential was last presented, in UTC, or null before its first use.
  • format date-time
Any of
string
null
revokedAtrequired
When the resource was revoked, in UTC, or null while it remains active.
  • format date-time
Any of
string
null
revokedByPrincipalIdrequired
The Principal that revoked this resource, or null while it remains active.
Any of
stringA Cantora Principal identifier, prefixed with `principal_`.
  • maximum length 64
  • pattern ^principal_[\s\S]+$
null

UnauthorizedEncoded

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "Unauthorized"
reasonrequired
stringA safe explanation of why the credential was rejected.

ForbiddenEncoded

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "Forbidden"
permissionrequired
stringThe permission required by the refused operation.

NotFoundEncoded

object
  • unknown properties allowed false
_tagrequired
stringThe stable machine-readable error type.
  • allowed values "NotFound"
resourcerequired
stringThe resource type relevant to the error.
idrequired
stringThe identifier supplied for the resource that was not found.

IdempotencyKey

stringA caller-chosen key of 1–200 visible ASCII characters that makes an identical request safe to retry.
  • maximum length 200
  • minimum length 1
  • pattern ^[!-~]+$