const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({reason: 'rotated'})
};
fetch('https://api.factify.com/v1/api-keys/{api_key_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.factify.com/v1/api-keys/{api_key_id}"
payload = { "reason": "rotated" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.factify.com/v1/api-keys/{api_key_id}"
payload := strings.NewReader("{\n \"reason\": \"rotated\"\n}")
req, _ := http.NewRequest("DELETE", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.delete("https://api.factify.com/v1/api-keys/{api_key_id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"reason\": \"rotated\"\n}")
.asString();curl --request DELETE \
--url https://api.factify.com/v1/api-keys/{api_key_id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"reason": "rotated"
}
'{
"type": "about:blank",
"title": "Bad Request",
"status": 400,
"detail": "Request body is malformed or missing required fields."
}{
"type": "about:blank",
"title": "Unauthorized",
"status": 401,
"detail": "Missing or invalid authentication credentials."
}{
"type": "about:blank",
"title": "Forbidden",
"status": 403,
"detail": "You do not have permission to perform this action on this resource."
}{
"type": "about:blank",
"title": "Not Found",
"status": 404,
"detail": "The requested resource does not exist or you do not have permission to view it."
}{
"type": "about:blank",
"title": "Unprocessable Entity",
"status": 422,
"detail": "Request body failed validation.",
"errors": [
{
"location": "body.email",
"message": "expected string to match format 'email'",
"value": "not-an-email"
}
]
}{
"type": "about:blank",
"title": "Too Many Requests",
"status": 429,
"detail": "Rate limit exceeded. Retry after the period indicated by the Retry-After header."
}{
"type": "about:blank",
"title": "Internal Server Error",
"status": 500,
"detail": "An unexpected error occurred. Retry, and contact support if the issue persists."
}Revoke an API key
Revokes an API key, immediately preventing it from being used for authentication. Revocation is permanent — to restore access, create a new key.
Authorization: requires organization admin role.
const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({reason: 'rotated'})
};
fetch('https://api.factify.com/v1/api-keys/{api_key_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.factify.com/v1/api-keys/{api_key_id}"
payload = { "reason": "rotated" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.factify.com/v1/api-keys/{api_key_id}"
payload := strings.NewReader("{\n \"reason\": \"rotated\"\n}")
req, _ := http.NewRequest("DELETE", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.delete("https://api.factify.com/v1/api-keys/{api_key_id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"reason\": \"rotated\"\n}")
.asString();curl --request DELETE \
--url https://api.factify.com/v1/api-keys/{api_key_id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"reason": "rotated"
}
'{
"type": "about:blank",
"title": "Bad Request",
"status": 400,
"detail": "Request body is malformed or missing required fields."
}{
"type": "about:blank",
"title": "Unauthorized",
"status": 401,
"detail": "Missing or invalid authentication credentials."
}{
"type": "about:blank",
"title": "Forbidden",
"status": 403,
"detail": "You do not have permission to perform this action on this resource."
}{
"type": "about:blank",
"title": "Not Found",
"status": 404,
"detail": "The requested resource does not exist or you do not have permission to view it."
}{
"type": "about:blank",
"title": "Unprocessable Entity",
"status": 422,
"detail": "Request body failed validation.",
"errors": [
{
"location": "body.email",
"message": "expected string to match format 'email'",
"value": "not-an-email"
}
]
}{
"type": "about:blank",
"title": "Too Many Requests",
"status": 429,
"detail": "Rate limit exceeded. Retry after the period indicated by the Retry-After header."
}{
"type": "about:blank",
"title": "Internal Server Error",
"status": 500,
"detail": "An unexpected error occurred. Retry, and contact support if the issue persists."
}Authorizations
Bearer authentication using a factapi-issued API key
(ffy_<env>_<base32_uuid><base62_random>). Cookie-based
sessions are accepted automatically by user-facing endpoints
but are not surfaced as an OpenAPI auth scheme.
Headers
Optional. Factify-staff acting-as override: when set, factapi
resolves the request against this organization instead of the
session-bound one. Honored only for callers with @factify.com
emails; non-staff requests carrying this header are rejected
with 403. The value is a typed org id (e.g.
org_01h2xcejqtf2nbrexx3vqjhp41).
^org_[0-9a-hjkmnp-tv-z]{26}$"org_01h2xcejqtf2nbrexx3vqjhp41"
Path Parameters
TypedID of the API key to revoke.
Pattern: key_[0-9a-hjkmnp-tv-z]{26}
"key_01h2xcejqtf2nbrexx3vqjhp41"
Body
Optional metadata for an API key revocation. The body itself is optional.
Optional human-readable reason for revocation (audit only). The revoking user's identity and timestamp are captured in audit logs separately.
"rotated"
Response
No Content