Skip to main content
POST
Revoke an API key

Authorizations

Authorization
string
header
required

Monid API key (Authorization: Bearer mk_...) or Clerk-issued JWT. Each operation lists the ONE scope an API key needs. {resource}:* grants every action on that resource; * grants everything; Clerk sessions hold *. Operations with an empty list need no scope. Scope catalog: GET /v1/api-keys/scopes.

Headers

X-Monid-Agent-Model
string

Model driving the calling agent. Optional; a value that is empty, longer than 256 characters or not printable ASCII is ignored (never an error).

Maximum string length: 256
X-Monid-Agent-Harness
string

Agent harness or client making the call (e.g. a coding agent, an agent framework). Optional; a value that is empty, longer than 256 characters or not printable ASCII is ignored (never an error).

Maximum string length: 256
X-Monid-Agent-Session-Id
string

Caller-side session identifier, so the calls of one agent session (discover → inspect → run → polling) can be correlated. Optional; a value that is empty, longer than 256 characters or not printable ASCII is ignored (never an error).

Maximum string length: 256

Path Parameters

label
string
required

Label of the API key to revoke.

Minimum string length: 1
Example:

"ci-runner"

Response

API key revoked

label
string
required

Human-readable label. Unique per workspace.

Example:

"ci-runner"

keyPrefix
string
required

Display prefix of the key (e.g. "monid_test_a1b2c3d4...").

Example:

"monid_test_a1b2c3d4"

owner
string
required

User id the key belongs to (bills to, listed under). Always a user; a child key inherits its parent's owner.

createdBy
string
required

Who minted the key — USER#<id> (dashboard), API_KEY#<fingerprint> (another key), AEP#<did> (AEP grant) — an actor id: USER#<userId> (dashboard), API_KEY#<fingerprint> (another key), AEP#<did> (an enrolled agent), CLERK, SYSTEM.

Example:

"USER#user_2abc"

scopes
enum<string>[]
required

Scope grants: {resource}:{action} over runs, resources, wallet, topups, controls and api_keys with read/create/update/delete, plus {resource}:* and *. Catalog reads need no scope. Fixed at creation.

Minimum array length: 1
Available options:
*,
runs:*,
resources:*,
wallet:*,
topups:*,
controls:*,
api_keys:*,
runs:create,
runs:get,
runs:list,
runs:update,
resources:read,
resources:create,
resources:update,
resources:delete,
wallet:read,
wallet:update,
topups:create,
controls:read,
controls:create,
controls:update,
controls:delete,
api_keys:read,
api_keys:create,
api_keys:update,
api_keys:revoke
Example:
status
enum<string>
required

ACTIVE, EXPIRED (derived from expiresAt) or REVOKED. Only ACTIVE keys authenticate.

Available options:
ACTIVE,
EXPIRED,
REVOKED
origin
enum<string>
required

Channel the key was minted through — derived from createdBy: DASHBOARD, API, AEP or SYSTEM.

Available options:
DASHBOARD,
API,
AEP,
SYSTEM
createdAt
string<date-time>
required

Creation time (ISO 8601).

expiresAt
string<date-time>

Expiry (ISO 8601). Absent ⇒ never expires.

revokedAt
string<date-time>

When the key was revoked. Present only when REVOKED.

revokedBy
string

Who revoked the key (present only when REVOKED) — an actor id: USER#<userId> (dashboard), API_KEY#<fingerprint> (another key), AEP#<did> (an enrolled agent), CLERK, SYSTEM.

Example:

"USER#user_2abc"

lastUsedAt
string<date-time>

Last time the key authenticated a request. Absent if never used.