Revoke API Key API

Introduced 3.7

Revokes an API key, making it immediately unusable for authentication. This is a soft delete: the key remains visible in list responses with a revoked_at timestamp.

Note the following when revoking API keys:

• Revocation is synchronous: the key is broadcast as invalid to all nodes before the response is returned.
• Revoked keys cannot be reactivated.
• The key name cannot be reused after revocation.

Endpoints

DELETE /_plugins/_security/api/apitokens/{id}

Path parameters

The following table lists the available path parameters.

Example request

DELETE _plugins/_security/api/apitokens/_ofOi6ABkhwU_cGa4M3v

Example response

{
  "message": "Token _ofOi6ABkhwU_cGa4M3v revoked successfully."
}

Response body fields

The response body is a JSON object with the following field.