revoke_api_key
REVOKES a CHILD key that the calling key issued (create_api_key): it stops authenticating immediately. Revokes ONLY the DIRECT children of the calling key (emitted_by_key_id) — not a sibling key, an account key set up from the settings, or the calling key itself; any other identifier is refused with a message saying so, nothing is written. RESERVED for MCP calls authenticated by a key carrying the emit_keys scope (the same family as create_api_key). This is the action of the orchestrator process that mints one key per agent: when the agent stops, it revokes its key instead of leaving a live key behind. Repeating the call on an already revoked key is harmless (alreadyRevoked: true). Frees a slot under the cap of live child keys per parent key.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| keyId | Yes | Identifier (UUID) of a DIRECT CHILD key of the calling key — the one returned by `create_api_key` in `apiKey.id`. A key that was not issued by the calling key (a sibling, an account key, the calling key itself) is refused. |