Revoke an API key
Immediate and irreversible: in-flight jobs keep running, the next request with that key
gets 401. Minimum role: admin.
Authorizations
Short-lived JWT issued by the CarHub auth service (Better Auth), verified against its
JWKS. Claims: sub (user), org_id (active organisation) and role
(owner | admin | member). Used by the dashboard for /mgmt/v1/… only — it is never
accepted on /v1/….
Path Parameters
API key identifier (not the secret).
^key_[1-9A-HJ-NP-Za-km-z]{8,32}$Response
Key revoked.
An organisation API key. The secret is never returned after creation.
"key_9TbR3xLm"
"api_key""Production — inspection worker"
Readable head of the key, enough to identify it in your logs.
"chk_live_a1b2"
Endpoint families the key may call. Empty means every family.
vehicle, vin, plate, document, dashboard, engine, video, damage, tire, parts, pricing, render, viewer, inspections Epoch seconds, UTC.
1755300000
Epoch seconds, UTC.
1755300000
Epoch seconds, UTC.
1755300000
User who created the key, kept for audit. Revoking that user does not affect the key.
"usr_5KpL2wQx"
Scheduled expiry, when the key was minted with one. Null for a perpetual key.
1755300000
End of the grace period of a rotated key: after this instant the previous secret stops working. Null when the key was never rotated.
1755300000