Delete API key

Deletes an API key on an account.

Endpoint

POST /api/v1/api-keys/{id}/delete

Authentication

Signing material is carried in the X-PUBLIC-KEY, X-SIGNATURE, and X-REQUEST-ID headers — see [SessionSigAuth]. Signed message: request_id (16) || account_id (8 LE) || api_key_id (16 raw bytes). The api_key_id is read from the URL path; the request_id’s embedded timestamp must fall inside the OG’s skew window.

Reach

Mirrors the visibility rule of handle_list_api_keys: the caller’s session must reach the target key’s scope. Pinned target → session must reach that subaccount; unpinned target → caller must hold an admin-rooted, unpinned session.

Returns

• 200 OK with DeleteApiKeyResponse (id, name, server-side deleted_at timestamp).
• 400 Bad Request if a signing header is malformed or the request_id’s embedded timestamp falls outside the skew window.
• 401 Unauthorized if a signing header is missing, signature verification fails, the session is invalid/expired, or the caller’s session does not reach the target key’s scope.
• 404 Not Found if the target key does not exist.
• 500 Internal Server Error if an internal error occurs while deleting the key; the key record is then left untouched, so a retry is safe.