Revoke an API key

POST/api/keys/{id}/revoke

Deletes one of your API keys. Clients that use it get 401 from then on.

Send Accept: application/json to get a JSON answer; otherwise you are redirected to /settings. The answer is the same whether or not the id belongs to one of your keys, and keys of other users are never touched. Available only when sign-in is enabled.

Authorizations

Authorizationstringheaderrequired

Needed only when the instance has sign-in enabled (PULLMD_AUTH_MODE is single-admin or multi-user). Send Bearer pmd_<key> with an API key created at /settings. In single-admin mode, the legacy PULLMD_AUTH_TOKEN is also accepted as a bearer token. OAuth access tokens work only on /mcp. Browser sessions use the pullmd_session cookie instead.

Path parameters

idintegerrequired

The numeric key id. The /settings page uses it in each key's revoke form; no API endpoint lists keys.

Example: 3

Response

200 · application/json

With Accept: application/json.

okboolean

Always true.

cURLcURLPythonJavaScript

curl --request POST \
  --url 'http://localhost:3000/api/keys/{id}/revoke' \
  --header 'Authorization: Bearer <token>'

{
  "ok": true
}