const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({reason: 'rotated'})
};
fetch('https://api.factify.com/v1/api-keys/{api_key_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"type": "about:blank",
"title": "Bad Request",
"status": 400,
"detail": "Request body is malformed or missing required fields."
}Revoke an API key
Revokes an API key, immediately preventing it from being used for authentication. Revocation is permanent — to restore access, create a new key.
Authorization: requires organization admin role.
const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({reason: 'rotated'})
};
fetch('https://api.factify.com/v1/api-keys/{api_key_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"type": "about:blank",
"title": "Bad Request",
"status": 400,
"detail": "Request body is malformed or missing required fields."
}Documentation Index
Fetch the complete documentation index at: https://developers.factify.com/llms.txt
Use this file to discover all available pages before exploring further.
Authorizations
Bearer authentication using a factapi-issued API key
(ffy_<env>_<base32_uuid><base62_random>). Cookie-based
sessions are accepted automatically by user-facing endpoints
but are not surfaced as an OpenAPI auth scheme.
Headers
Optional. Factify-staff acting-as override: when set, factapi
resolves the request against this organization instead of the
session-bound one. Honored only for callers with @factify.com
emails; non-staff requests carrying this header are rejected
with 403. The value is a typed org id (e.g.
org_01h2xcejqtf2nbrexx3vqjhp41).
^org_[0-9a-hjkmnp-tv-z]{26}$"org_01h2xcejqtf2nbrexx3vqjhp41"
Path Parameters
TypedID of the API key to revoke.
Pattern: key_[0-9a-hjkmnp-tv-z]{26}
"key_01h2xcejqtf2nbrexx3vqjhp41"
Body
Optional metadata for an API key revocation. The body itself is optional.
Optional human-readable reason for revocation (audit only). The revoking user's identity and timestamp are captured in audit logs separately.
"rotated"
Response
No Content