You're viewing version 3.8 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

Revoke API Key API

Introduced 3.7

Revokes an API key, making it immediately unusable for authentication. This is a soft delete: the key remains visible in list responses with a revoked_at timestamp.

Note the following when revoking API keys:

• Revocation is synchronous: the key is broadcast as invalid to all nodes before the response is returned.
• Revoked keys cannot be reactivated.
• The key name cannot be reused after revocation.

Endpoints

DELETE /_plugins/_security/api/apitokens/{id}

Path parameters

The following table lists the available path parameters.

Example request

DELETE _plugins/_security/api/apitokens/_ofOi6ABkhwU_cGa4M3v

Example response

{
  "message": "Token _ofOi6ABkhwU_cGa4M3v revoked successfully."
}

Response body fields

The response body is a JSON object with the following field.