Revoke an API key
Revokes the key identified by apiKeyId, flipping its status to revoked so its secret can no longer authenticate.
Revokes the key identified by apiKeyId, flipping its status to revoked so its secret can no longer authenticate. Keys are deactivated rather than deleted, so the revoked key stays visible in the list. A successful revoke returns 204 No Content with an empty body and requires the keys:write scope and a key whose creator is an organization owner or admin (403 otherwise); to revoke the calling key itself without that role, use DELETE /v1/api-keys/current. Revoking also archives any key-scoped budget attached to the key so it stops appearing in the budgets list, and records a security notification on the account. An unknown or blank apiKeyId, or a key outside the inboxes of a calling key restricted to specific inboxes, returns 404; revoking a key that is already revoked is a safe no-op that still returns 204.
Scope: keys:write. Send the API key as a bearer token; Scopes lists what each one reaches.
Request
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
apiKeyId | string | yes | The API key's ID. |
Response
200 Success. Body: application/json, DeleteResponse.
| Field | Type | Required | Description |
|---|---|---|---|
deleted | boolean | yes |
Errors
Every error has the same body, {"error": {"type", "code", "message", "param"}}; branch on code. Errors lists every code.
| Status | Meaning |
|---|---|
400 | The request is malformed or a value is invalid (invalid_request, invalid_domain, idempotency_key_mismatch). |
401 | The API key is missing or invalid. |
403 | The key lacks the scope this endpoint needs (scope_missing) or may not do this (not_permitted). |
404 | No such resource in this account (resource_not_found). |
422 | The request is well-formed but a field failed validation (validation_failed). |
429 | Rate limit, plan limit, budget or spend cap reached (rate_limited, plan_limit_reached, budget_exceeded, spend_cap_reached). |
500 | An unexpected error; retry with backoff, then contact support (internal_error). |
Update an API key's name, IP allowlist or inbox restriction
Updates the mutable fields of the key identified by apiKeyId: its name, its allowedIps, its inboxIds restriction, or any combination.
Get attachment metadata
Returns metadata for one email attachment by attachmentId — its filename, contentType, sizeBytes, contentId, disposition, and createdAt, plus the messageId it belongs to.