You're viewing version 3.7 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

Revoke an API Key API

Introduced 3.7

Revokes an API key, making it immediately unusable for authentication. This is a soft delete: the key remains visible in list responses with a revoked_at timestamp.

Note the following behavior when revoking API keys:

• Revocation is synchronous: the key is broadcast as invalid to all nodes before the response is returned.
• Revoked keys cannot be reactivated.
• The key name cannot be reused after revocation.

Endpoints

DELETE /_plugins/_security/api/apitokens/{id}

Path parameters

The following table lists the available path parameters.

Example request

DELETE /_plugins/_security/api/apitokens/DjxGIp4BkXkgMZpmeGvx

Example response

{
  "message": "Token revoked successfully"
}