API Reference

Bulk Revoke API Keys

Revoke up to 100 API keys in a single call. Each key is processed independently — invalid ids do not abort the batch. Already-revoked keys are reported as already_revoked rather than treated as errors, so the operation is safely retryable.

POST/org/api-keys/bulk-revoke

Authentication

Accepts a JWT bearer token (Authorization: Bearer eyJ…) or an API key (X-API-Key: ms_live_…). API-key callers should send X-Project-ID unless the key is project-locked. Cross-tenant operators must send X-Tenant-ID.

Request body

Field	Type	Required	Description
`key_ids`	`integer[]`	required	Distinct key ids. Length `1..100`. Duplicates are silently de-duplicated server-side.

request.json

{
  "key_ids": [
    501,
    502,
    503
  ]
}

Response

Returns 200 OK with the following body.

Field	Type	Required	Description
`revoked`	`integer`	optional	Keys transitioned to `revoked` by this call.
`already_revoked`	`integer`	optional	Keys that were already revoked.
`not_found`	`integer`	optional	Ids missing or owned by another tenant/project.
`results`	`object[]`	optional	Per-key rows: `{ key_id, status: revoked\|already_revoked\|not_found\|forbidden }`.

200.json

{
  "revoked": 2,
  "already_revoked": 1,
  "not_found": 0,
  "results": [
    {
      "key_id": 501,
      "status": "revoked"
    },
    {
      "key_id": 502,
      "status": "revoked"
    },
    {
      "key_id": 503,
      "status": "already_revoked"
    }
  ]
}

Errors

Status	Code	Description
400	`validation_error`	Body or query failed schema validation. The error includes the offending `field` name.
401	`unauthenticated`	Missing or invalid bearer token / API key.
403	`forbidden`	Authenticated principal lacks the required scope, role, or project access.
404	`not_found`	Target resource does not exist or is not visible to the calling tenant.
429	`rate_limited`	Per-IP or per-route limit exceeded. Respect the `Retry-After` header.
500	`internal_error`	Unhandled server error. Quote the `request_id` when contacting support.

Examples

cURL

curl -X POST https://api.memorysync.io/org/api-keys/bulk-revoke \
  -H "Authorization: Bearer $MEMORYSYNC_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "key_ids": [
    501,
    502,
    503
  ]
}'

javascript

import { MemorySync } from 'memorysync'

const client = new MemorySync({ apiKey: process.env.MEMORYSYNC_KEY })

const result = await client.request({
  method: 'POST',
  path: '/org/api-keys/bulk-revoke',
  body: {
    "key_ids": [
      501,
      502,
      503
    ]
  },
})
console.log(result)

python

from memorysync import Client

client = Client(api_key=os.environ["MEMORYSYNC_KEY"])

result = client.request(
    method="POST",
    path="/org/api-keys/bulk-revoke",
    json={
      "key_ids": [
        501,
        502,
        503
      ]
    },
)
print(result)

Behavior & notes

Requires owner, admin, or developer role and admin:write scope. Each successfully revoked key emits an api_key.revoked webhook event after the database commit. Cross-project requests (X-Project-ID header set) only see keys scoped to that project.

← Previous

List Deliveries

Test Key