> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke a leaked or unused API key now

> Stop a key authenticating, immediately and permanently, and read back when it happened. Takes a console session, so a key cannot revoke a key. Repeats are safe.

This endpoint takes a **signed-in console session**, not an API key. Send the session cookies your browser received when you signed in, plus the `X-CSRF-Token` header set to the value of the `csrf_token` cookie. A request authenticated with an `arukz_sk_` key is refused with `403`. See [Managing API keys](/administration/api-keys).

Revocation is:

* **Immediate.** The key fails authentication on the very next request. There is no cache to wait out.
* **Terminal.** A revoked key cannot be reactivated. To restore access, create a new key.
* **Idempotent.** Revoking a key that is already revoked succeeds and returns it unchanged, with its original `revoked_at`.

The response is `200` with the revoked key rather than `204`, so you can read `revoked_at` without a second request. The key stays in [List API keys](/api-reference/api-keys/list-api-keys) with `status` set to `revoked`.

A key that does not exist, a key in another organization and a malformed ID all return the same `404`. You need the owner or admin role.

<ParamField path="api_key_id" type="string" required>
  The key's ID (UUID), as returned in `id`.
</ParamField>

<ParamField header="X-CSRF-Token" type="string" required>
  The value of your session's `csrf_token` cookie (named `__Host-csrf_token` when the console is
  served over HTTPS without a shared cookie domain). Required on this request because it changes
  state; a missing or mismatched token returns `401`.
</ParamField>

## Response

<ResponseField name="id" type="string" required>
  The key's ID (UUID).
</ResponseField>

<ResponseField name="name" type="string" required>
  The key's label.
</ResponseField>

<ResponseField name="prefix" type="string" required>
  `arukz_sk_` followed by the first 8 characters of the ID. Not a secret.
</ResponseField>

<ResponseField name="role" type="string" required>
  `owner`, `admin`, `editor`, `normal` or `dataset_operator`.
</ResponseField>

<ResponseField name="status" type="string" required>
  Always `revoked`.
</ResponseField>

<ResponseField name="created_at" type="string" required>
  When the key was created, ISO 8601 in UTC.
</ResponseField>

<ResponseField name="created_by" type="string | null" required>
  ID of the user who created the key.
</ResponseField>

<ResponseField name="expires_at" type="string | null" required>
  When the key would have expired, or `null`.
</ResponseField>

<ResponseField name="revoked_at" type="string" required>
  When the key was revoked, ISO 8601 in UTC.
</ResponseField>

<ResponseField name="last_used_at" type="string | null" required>
  When the key last authenticated a request, or `null` if never.
</ResponseField>

<RequestExample>
  ```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
  # cookies.txt holds the cookies from your signed-in console session.
  curl --request DELETE "$MITHUNAI_URL/arukz/api/v1/api-keys/3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b" \
    --cookie cookies.txt \
    --header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN"
  ```

  ```python Python theme={"theme":{"light":"github-light","dark":"github-dark"}}
  import os
  from http.cookiejar import MozillaCookieJar

  import requests

  jar = MozillaCookieJar("cookies.txt")
  jar.load()

  key_id = "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b"
  response = requests.delete(
      f"{os.environ['MITHUNAI_URL']}/arukz/api/v1/api-keys/{key_id}",
      cookies=jar,
      headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
      timeout=30,
  )
  response.raise_for_status()
  print(response.json()["revoked_at"])
  ```

  ```javascript JavaScript theme={"theme":{"light":"github-light","dark":"github-dark"}}
  // Runs in a page on the MITHUNAI console's own origin, while signed in.
  // csrfToken is the value of the csrf_token cookie.
  const keyId = '3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b'
  const response = await fetch(`/arukz/api/v1/api-keys/${keyId}`, {
    method: 'DELETE',
    credentials: 'include',
    headers: { 'X-CSRF-Token': csrfToken },
  })
  console.log((await response.json()).revoked_at)
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  {
    "id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
    "name": "CI pipeline",
    "prefix": "arukz_sk_3f2a1c9e",
    "role": "normal",
    "status": "revoked",
    "created_at": "2026-09-20T14:03:11.482190+00:00",
    "created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "expires_at": "2026-12-19T14:03:11.482190+00:00",
    "revoked_at": "2026-09-24T09:12:05.640021+00:00",
    "last_used_at": "2026-09-23T08:41:52.117004+00:00"
  }
  ```

  ```json 401 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "authentication_error", "message": "Authentication is required." }
  ```

  ```json 403 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "authorization_error", "message": "API key management requires a signed-in user." }
  ```

  ```json 404 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "not_found", "message": "The requested resource was not found." }
  ```
</ResponseExample>