Revoke a leaked or unused API key now

DELETE

api-keys

{api_key_id}

# cookies.txt holds the cookies from your signed-in console session.
curl --request DELETE "$MITHUNAI_URL/arukz/api/v1/api-keys/3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b" \
  --cookie cookies.txt \
  --header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN"

import os
from http.cookiejar import MozillaCookieJar

import requests

jar = MozillaCookieJar("cookies.txt")
jar.load()

key_id = "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b"
response = requests.delete(
    f"{os.environ['MITHUNAI_URL']}/arukz/api/v1/api-keys/{key_id}",
    cookies=jar,
    headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
    timeout=30,
)
response.raise_for_status()
print(response.json()["revoked_at"])

// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const keyId = '3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b'
const response = await fetch(`/arukz/api/v1/api-keys/${keyId}`, {
  method: 'DELETE',
  credentials: 'include',
  headers: { 'X-CSRF-Token': csrfToken },
})
console.log((await response.json()).revoked_at)

{
  "id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
  "name": "CI pipeline",
  "prefix": "arukz_sk_3f2a1c9e",
  "role": "normal",
  "status": "revoked",
  "created_at": "2026-09-20T14:03:11.482190+00:00",
  "created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "expires_at": "2026-12-19T14:03:11.482190+00:00",
  "revoked_at": "2026-09-24T09:12:05.640021+00:00",
  "last_used_at": "2026-09-23T08:41:52.117004+00:00"
}

{ "code": "authentication_error", "message": "Authentication is required." }

{ "code": "authorization_error", "message": "API key management requires a signed-in user." }

{ "code": "not_found", "message": "The requested resource was not found." }

This endpoint takes a signed-in console session, not an API key. Send the session cookies your browser received when you signed in, plus the X-CSRF-Token header set to the value of the csrf_token cookie. A request authenticated with an arukz_sk_ key is refused with 403. See Managing API keys. Revocation is:

Immediate. The key fails authentication on the very next request. There is no cache to wait out.
Terminal. A revoked key cannot be reactivated. To restore access, create a new key.
Idempotent. Revoking a key that is already revoked succeeds and returns it unchanged, with its original revoked_at.

The response is 200 with the revoked key rather than 204, so you can read revoked_at without a second request. The key stays in List API keys with status set to revoked. A key that does not exist, a key in another organization and a malformed ID all return the same 404. You need the owner or admin role.

string

required

The key’s ID (UUID), as returned in id.

string

required

The value of your session’s csrf_token cookie (named __Host-csrf_token when the console is served over HTTPS without a shared cookie domain). Required on this request because it changes state; a missing or mismatched token returns 401.

Response

string

required

The key’s ID (UUID).

string

required

The key’s label.

string

required

arukz_sk_ followed by the first 8 characters of the ID. Not a secret.

string

required

owner, admin, editor, normal or dataset_operator.

string

required

Always revoked.

string

required

When the key was created, ISO 8601 in UTC.

string | null

required

ID of the user who created the key.

string | null

required

When the key would have expired, or null.

string

required

When the key was revoked, ISO 8601 in UTC.

string | null

required

When the key last authenticated a request, or null if never.

# cookies.txt holds the cookies from your signed-in console session.
curl --request DELETE "$MITHUNAI_URL/arukz/api/v1/api-keys/3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b" \
  --cookie cookies.txt \
  --header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN"

import os
from http.cookiejar import MozillaCookieJar

import requests

jar = MozillaCookieJar("cookies.txt")
jar.load()

key_id = "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b"
response = requests.delete(
    f"{os.environ['MITHUNAI_URL']}/arukz/api/v1/api-keys/{key_id}",
    cookies=jar,
    headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
    timeout=30,
)
response.raise_for_status()
print(response.json()["revoked_at"])

// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const keyId = '3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b'
const response = await fetch(`/arukz/api/v1/api-keys/${keyId}`, {
  method: 'DELETE',
  credentials: 'include',
  headers: { 'X-CSRF-Token': csrfToken },
})
console.log((await response.json()).revoked_at)

{
  "id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
  "name": "CI pipeline",
  "prefix": "arukz_sk_3f2a1c9e",
  "role": "normal",
  "status": "revoked",
  "created_at": "2026-09-20T14:03:11.482190+00:00",
  "created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "expires_at": "2026-12-19T14:03:11.482190+00:00",
  "revoked_at": "2026-09-24T09:12:05.640021+00:00",
  "last_used_at": "2026-09-23T08:41:52.117004+00:00"
}

{ "code": "authentication_error", "message": "Authentication is required." }

{ "code": "authorization_error", "message": "API key management requires a signed-in user." }

{ "code": "not_found", "message": "The requested resource was not found." }

Last modified on September 26, 2026

⌘I

# cookies.txt holds the cookies from your signed-in console session.
curl --request DELETE "$MITHUNAI_URL/arukz/api/v1/api-keys/3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b" \
  --cookie cookies.txt \
  --header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN"

import os
from http.cookiejar import MozillaCookieJar

import requests

jar = MozillaCookieJar("cookies.txt")
jar.load()

key_id = "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b"
response = requests.delete(
    f"{os.environ['MITHUNAI_URL']}/arukz/api/v1/api-keys/{key_id}",
    cookies=jar,
    headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
    timeout=30,
)
response.raise_for_status()
print(response.json()["revoked_at"])

// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const keyId = '3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b'
const response = await fetch(`/arukz/api/v1/api-keys/${keyId}`, {
  method: 'DELETE',
  credentials: 'include',
  headers: { 'X-CSRF-Token': csrfToken },
})
console.log((await response.json()).revoked_at)

{
  "id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
  "name": "CI pipeline",
  "prefix": "arukz_sk_3f2a1c9e",
  "role": "normal",
  "status": "revoked",
  "created_at": "2026-09-20T14:03:11.482190+00:00",
  "created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "expires_at": "2026-12-19T14:03:11.482190+00:00",
  "revoked_at": "2026-09-24T09:12:05.640021+00:00",
  "last_used_at": "2026-09-23T08:41:52.117004+00:00"
}

{ "code": "authentication_error", "message": "Authentication is required." }

{ "code": "authorization_error", "message": "API key management requires a signed-in user." }

{ "code": "not_found", "message": "The requested resource was not found." }

Get started

Conversations

Assistants

Models

Knowledge

Widget deployments

Widget (public)

MCP

API keys

Members

Analytics

Support access

Branding

Operations

Revoke a leaked or unused API key now

Response

​Response

Response