Skip to main content
DELETE
Revoke an API key

Authorizations

Authorization
string
header
required

Short-lived JWT issued by the CarHub auth service (Better Auth), verified against its JWKS. Claims: sub (user), org_id (active organisation) and role (owner | admin | member). Used by the dashboard for /mgmt/v1/… only — it is never accepted on /v1/….

Path Parameters

id
string
required

API key identifier (not the secret).

Pattern: ^key_[1-9A-HJ-NP-Za-km-z]{8,32}$

Response

Key revoked.

An organisation API key. The secret is never returned after creation.

id
string
required
Example:

"key_9TbR3xLm"

object
string
required
Allowed value: "api_key"
name
string
required
Example:

"Production — inspection worker"

prefix
string
required

Readable head of the key, enough to identify it in your logs.

Example:

"chk_live_a1b2"

livemode
boolean
required
scopes
enum<string>[]
required

Endpoint families the key may call. Empty means every family.

Available options:
vehicle,
vin,
plate,
document,
dashboard,
engine,
video,
damage,
tire,
parts,
pricing,
render,
viewer,
inspections
created
integer<int64>
required

Epoch seconds, UTC.

Example:

1755300000

last_used_at
integer<int64> | null
required

Epoch seconds, UTC.

Example:

1755300000

revoked_at
integer<int64> | null
required

Epoch seconds, UTC.

Example:

1755300000

created_by
string | null

User who created the key, kept for audit. Revoking that user does not affect the key.

Example:

"usr_5KpL2wQx"

expires_at
integer<int64> | null

Scheduled expiry, when the key was minted with one. Null for a perpetual key.

Example:

1755300000

rotates_at
integer<int64> | null

End of the grace period of a rotated key: after this instant the previous secret stops working. Null when the key was never rotated.

Example:

1755300000