Delete an API key
/api/v1/api-keys/{id}Permanently deletes an API key from the active Environment. The row is removed entirely rather than just disabled, so the key can never authenticate again and disappears from listings; the lifecycle remains traceable in the audit log. Returns 204 No Content on success and 404 when no key with the given id exists in the active Environment. A scoped API key can act only on scoped keys whose scopes it holds itself; any other key is refused with 403.
Authentication
Authorization Option A JWT access token. Never send alongside X-API-Key: a request carrying both is refused.
X-API-Key Option B API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.
Path Parameters
idstring Required Responses
API key deleted
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
Errors
When the request can't be completed, the response body includes a stable error code you can branch on, and a correlation_id (also sent as the X-Correlation-Id header). Quote the correlation id when you contact support: it identifies the exact request in Canopy's logs.
api_key.access_exceeds_callerForbiddenThe caller is a scoped API key asking for more than it holds, or acting on a key that has more: a full-access key, or a scope outside its own. Applies to creating, rotating, enabling, disabling and deleting keys.
Request only scopes the calling key already holds, or make the change from the Console or with a full-access key.
curl -X DELETE "https://auth.canopy-io.com/api/v1/api-keys/value" \ -H "X-API-Key: $CANOPY_API_KEY"
HTTP/1.1 204 API key deleted (empty body)
Tell us how we can improve this guide.