Revoke API key - Tradara

POST /v1/firm-control/api-keys/revoke

operationId: revokeAPIKey Revokes a firm API key by key_id. Revoked keys cannot authenticate further requests.

Headers

Header	Notes
`X-Firm-ID`	Firm UUID. Auto-injected for firm API keys.

Body

Field	Required	Notes
`key_id`	yes	UUID of the key to revoke.

Example

curl -X POST "$TRADARA_BASE_URL/v1/firm-control/api-keys/revoke" \
  -H "X-Tradara-Api-Key: $TRADARA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "key_id": "key_01HW..." }'

Response — `200 OK`

Returns the updated FirmAPIKey with status: "REVOKED" and revoked_at set.

{
  "id": "key_01HW...",
  "firm_id": "8f4a1d6e-2b1c-4e9a-9d3b-5e6c7a0d1f23",
  "name": "prod-orderbot",
  "key_prefix": "tdr_live_4f2c8",
  "scopes": ["orders:write", "fills:read", "balances:read"],
  "status": "REVOKED",
  "created_by_user_id": "usr_01HW...",
  "last_used_at": "2026-06-26T15:59:00Z",
  "expires_at": "2027-01-01T00:00:00Z",
  "revoked_at": "2026-06-26T16:00:00Z",
  "revoked_by_user_id": "usr_01HV...",
  "created_at": "2026-06-01T00:00:00Z",
  "updated_at": "2026-06-26T16:00:00Z"
}

Revocation is permanent. To replace a key in flight, mint the new one first, switch your services over, then revoke the old key.