Irreversibly revoke a key (api_key.revoke)
Verified session required. Membership and current dynamic permissions are checked on every request. Writes require the configured trusted Origin.
/platform/organizations/{organizationId}/projects/{projectId}/api-keys/{keyId}/revokeVerified session required. Membership and current dynamic permissions are checked on every request. Writes require the configured trusted Origin.
Authorization
accountSession Better Auth signed HttpOnly session cookie; HTTPS uses the __Secure-better-auth.session_token name. Sign in through /api/auth. Browser clients send cookies automatically; do not paste secrets into docs.
In: cookie
Path Parameters
Tenant-scoped resource identifier.
uuidTenant-scoped resource identifier.
uuidTenant-scoped resource identifier.
uuidResponse Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/platform/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/projects/497f6eca-6276-4993-bfeb-53cbbbba6f08/api-keys/497f6eca-6276-4993-bfeb-53cbbbba6f08/revoke"{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "projectId": "5a8591dd-4039-49df-9202-96385ba3eff8", "name": "string", "prefix": "string", "scopes": [ "string" ], "createdAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z", "expiresAt": "2019-08-24T14:15:22Z", "revokedAt": "2019-08-24T14:15:22Z"}Create a scoped project key (api_key.create) POST
Verified session required. Membership and current dynamic permissions are checked on every request. Writes require the configured trusted Origin.
Report recorded project usage (usage.read) GET
Verified session and current membership/usage.read required; bearer keys are not accepted. Inclusive UTC date range, 1–90 days, no future dates, earliest 1970-01-01. Supply both dates or neither (last 30 days including today). Today's bucket is partial. Missing days are zero-filled. This is best-effort recorded usage, not a billing statement. Bootstrap traffic and rejections before the interceptor, including rate limits, are excluded. Persistence failures can leave gaps. Batch HTTP requests count once; item failures within successful responses are not HTTP errors. Submitted characters are Unicode code points, including failed requests that reached the interceptor. No submitted text is retained or returned. Counter strings preserve exact integer precision. Handler durations exclude network, guards and usage persistence. Totals match the returned buckets.