Revoke an API key

POST 
/api-keys/:id/revoke

Soft-deletes (revokes) an API key by recording a revoked_at timestamp. The key record is retained in the database but is rejected by the authentication middleware. To permanently remove the record, use DELETE /api-keys/{id}.

Regular users may only revoke their own keys. Administrators may revoke any key.

Request

Responses

200

API key revoked successfully.

401

Unauthorized. No active WordPress session.

403

Forbidden. The authenticated user does not own this API key and does not have administrator privileges.

404

No API key with the provided ID was found.

500

Internal server error. The database revoke operation failed.