Revoke an API key
Revokes a key immediately — in-flight and future requests with it fail with 401. Revocation is permanent; revoked keys remain listed for audit. Session auth only.
Authorizations
Authorization: Bearer <token>. Token types resolve to the same scoped credential: a user-generated API key (casa_…, from Account settings — recommended for machines and MCP clients), a WorkOS AuthKit session JWT (the web app; org and role come from verified token claims), or a static token. API keys are group-scoped, optionally pinned to one property at creation. MCP OAuth connector tokens authenticate the MCP server only and are rejected on these REST routes.
Headers
Active WorkOS organization (property group). Optional cross-check for session (JWT) auth: when sent it must equal the token's verified org_id claim, else 403. The org is taken from the claim, not this header. Ignored for API keys and static tokens.
Path Parameters
Resource id (UUID).
Response
Revoked.
"revoked"