API Keys
Revoke an API key
Revoke an API key. The key is immediately invalidated and can no longer be used for authentication. This action cannot be undone.
For team and organization keys, the associated service account is also deleted. Any active sessions using this key will fail on the next request.
DELETE
Revoke an API key
Documentation Index
Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
Use this file to discover all available pages before exploring further.
Previous
Rotate an API keyRotate an API key's token. Issues a new secret token and returns it — **the new token is only shown once**, so store it securely.
**Self-only:** You can only rotate the API key that was used to authenticate this request. Attempting to rotate a different key returns `403 Forbidden`.
**Grace period:** When enabled for your organization, the previous token remains valid after rotation, giving you time to deploy the new token without downtime. Pass `grace_period_minutes` (integer, 0–1440, default 30) to control how long the old token stays valid. Set to 0 to immediately invalidate the old token. The `grace_period_ends_at` field in the response confirms the exact time the old token will stop working.
**Expiration:** Optionally provide a new `expires_at` date (ISO 8601, up to 5 years). Defaults to 90 days from now if omitted. Dates in the past are rejected.
**Typical rotation workflow:**
1. Call this endpoint to get a new token (optionally with a custom `grace_period_minutes`).
2. Deploy the new token to your systems.
3. The old token continues working for `grace_period_minutes` (if grace period is enabled).
4. After the grace period, the old token is automatically invalidated.
Next
Revoke an API key