Skip to main content
POST
Revoke a signing key

Authorizations

Authorization
string
header
required

A personal access token (POST /v1/auth/tokens) or a machine identity token (POST /v1/projects/{project_id}/identities/{identity_id}/tokens), both prefixed qumo_pat_. A token's scopes cap what it can do; see Scopes and permissions. A personal token names no organization: on a route whose path names no project or organization, pass ?organization_id=.

Path Parameters

id
string<uuid>
required

The project's id.

kid
string
required

The key's id, its RFC 7638 JWK thumbprint.

Response

The revoked key.

A registered signing key.

kid
string
required

The key's RFC 7638 JWK thumbprint, the kid your credentials carry.

Example:

"NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"

project_id
string<uuid>
required

The project the key belongs to.

Example:

"9b1d6e2f-4a3c-4f8b-a7e5-0c9d2b4f6e81"

name
string
required

Display name.

Example:

"api-server"

prefix
string
required

Every path a credential signed with this key grants must lie within this prefix: the project root <organization slug>/<project slug>, or a narrower path under it.

Example:

"acme/live/cameras"

public_key
object
required

The public half of an Ed25519 key, as a JWK (RFC 8037).

state
enum<string>
required

Whether managed relays trust the key.

Available options:
active,
revoked
Example:

"active"

created_at
string<date-time>
required

When the key was registered.

Example:

"2026-10-20T14:03:52Z"

revoked_at
string<date-time> | null
required

When the key was revoked, or null.

Example:

null