> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Revoke multiple API keys > Revokes up to 100 API keys in one call. Send `key_ids` plus an optional `reason`; ownership of every id is verified before any key is revoked — if one id does not belong to your organization nothing changes. Keys already revoked are skipped and reported separately, and each revoked key is recorded in the audit log individually, exactly as a single revoke would be. Owner, admin or developer. ## OpenAPI ````yaml /openapi.yaml post /api/v1/settings/api-keys/bulk-revoke openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Telegram description: >- Telegram bring-your-own-bot channel: connect a bot, verify a chat against the shared sandbox bot, and read unified channel state. Production sends go through the Messaging API. - name: USSD description: >- Menu-driven USSD for feature phones: define a menu tree, simulate session steps, and host the tenant-scoped aggregator callback. - name: Integrations description: Third-party service connections and OAuth management - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Messaging Services description: >- Twilio MessagingService-parity containers bundling sender pool, opt-out list, inbound webhook, and sticky-sender/geomatch flags - name: Sender Pools description: >- Group sending numbers into pools with a selection strategy (sticky / round-robin / random) for outbound sends - name: Opt-Out Lists description: >- Per-list STOP / HELP / START keyword sets and auto-response copy (Twilio Advanced Opt-Out parity) - name: SMPP description: Tenant BYO-SMPP bind credentials and upstream termination carriers - name: Commerce description: >- Unified omnichannel conversational-commerce: cart/checkout state machine, cross-channel payment reconciliation, hosted pay-by-link, native WhatsApp checkout, and agentic-checkout payment mandates - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /api/v1/settings/api-keys/bulk-revoke: post: tags: - Settings summary: Revoke multiple API keys description: >- Revokes up to 100 API keys in one call. Send `key_ids` plus an optional `reason`; ownership of every id is verified before any key is revoked — if one id does not belong to your organization nothing changes. Keys already revoked are skipped and reported separately, and each revoked key is recorded in the audit log individually, exactly as a single revoke would be. Owner, admin or developer. parameters: - name: Idempotency-Key in: header required: false description: >- Stripe-style idempotency token. Pass a stable, client-generated value (1-255 chars) to dedupe retries on transient timeouts. The same key+credential+path replays the original response for 24h on 2xx (5min on 4xx, 30s on 5xx). Returns 409 if a concurrent request with the same key is already in flight; replayed responses include the `Idempotency-Replay: true` response header. schema: type: string minLength: 1 maxLength: 255 - name: X-Test-Mode in: header required: false description: >- Sandbox opt-in for Clerk-session-authenticated requests. Set to `true` to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response `meta.test_mode: true`. **Ignored for live API keys (`dv_live_sk_*`)** — server-to-server clients must use a test-prefixed key (`dv_test_sk_*`) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header. schema: type: string enum: - 'true' - 'false' responses: '200': description: Which keys were revoked and which were already revoked. content: application/json: schema: type: object description: Which keys were revoked and which were already revoked. properties: data: type: object additionalProperties: true description: Revocation outcome. properties: revokedCount: type: - 'null' - integer description: How many keys were revoked by this call. alreadyRevokedCount: type: - 'null' - integer description: >- How many of the supplied keys had already been revoked. revoked: type: - 'null' - array items: type: object additionalProperties: true description: >- One API key — secrets are never returned, only metadata. properties: id: type: string description: API key id. name: type: - 'null' - string description: Key label. keyPrefix: type: - 'null' - string description: >- Public prefix of the key, e.g. `sk_live_`, shown for identification. lastFourChars: type: - 'null' - string description: >- Last four characters of the secret — enough to identify the key without exposing it. type: type: - 'null' - string description: >- Key type — `secret` (server-to-server) or `public` (widget / client-side). active: type: - 'null' - boolean description: Whether the key currently authenticates. lastUsedAt: type: - 'null' - string format: date-time description: When the key last authenticated a request. lastUsedIp: type: - 'null' - string description: Source IP of the last authenticated request. expiresAt: type: - 'null' - string format: date-time description: When the key stops authenticating. revokeAt: type: - 'null' - string format: date-time description: >- Scheduled revocation cutoff — the key keeps working until this instant. allowedIps: type: - 'null' - array items: type: string description: >- Source-IP allowlist (IPs or CIDRs). Null or empty means the key works from anywhere. scopes: type: - 'null' - array items: type: string description: >- Scopes declared at mint time. Null or empty means full access. mintedByRole: type: - 'null' - string description: >- Role of the user who minted the key, e.g. `owner` or `developer`. createdAt: type: - 'null' - string format: date-time description: When the key was created. description: The keys this call revoked. alreadyRevoked: type: - 'null' - array items: type: object additionalProperties: true description: >- One API key — secrets are never returned, only metadata. properties: id: type: string description: API key id. name: type: - 'null' - string description: Key label. keyPrefix: type: - 'null' - string description: >- Public prefix of the key, e.g. `sk_live_`, shown for identification. lastFourChars: type: - 'null' - string description: >- Last four characters of the secret — enough to identify the key without exposing it. type: type: - 'null' - string description: >- Key type — `secret` (server-to-server) or `public` (widget / client-side). active: type: - 'null' - boolean description: Whether the key currently authenticates. lastUsedAt: type: - 'null' - string format: date-time description: When the key last authenticated a request. lastUsedIp: type: - 'null' - string description: Source IP of the last authenticated request. expiresAt: type: - 'null' - string format: date-time description: When the key stops authenticating. revokeAt: type: - 'null' - string format: date-time description: >- Scheduled revocation cutoff — the key keeps working until this instant. allowedIps: type: - 'null' - array items: type: string description: >- Source-IP allowlist (IPs or CIDRs). Null or empty means the key works from anywhere. scopes: type: - 'null' - array items: type: string description: >- Scopes declared at mint time. Null or empty means full access. mintedByRole: type: - 'null' - string description: >- Role of the user who minted the key, e.g. `owner` or `developer`. createdAt: type: - 'null' - string format: date-time description: When the key was created. description: >- Supplied keys that were already revoked before the call. meta: type: object properties: request_id: type: string description: >- Unique request identifier (also returned in X-Request-Id header) timestamp: type: string format: date-time description: ISO 8601 UTC timestamp of the response headers: Idempotency-Replay: description: >- Set to `true` when the response is a cached replay of a prior request with the same `Idempotency-Key`. Absent (or `false`) on first-write responses. schema: type: string '400': $ref: '#/components/responses/StandardError' '401': $ref: '#/components/responses/StandardError' '403': $ref: '#/components/responses/StandardError' '404': $ref: '#/components/responses/StandardError' '422': $ref: '#/components/responses/StandardError' '429': $ref: '#/components/responses/RateLimitedResponse' '500': $ref: '#/components/responses/StandardError' components: responses: StandardError: description: >- Standard error envelope. `error.code` is machine-readable; see the [error reference](https://docs.orbit.devotel.io/reference/error-codes) for the catalogue. content: application/json: schema: type: object properties: error: type: object required: - code - message - status properties: code: type: string description: Machine-readable error code (e.g. INVALID_PHONE_NUMBER) message: type: string description: Human-readable error description status: type: integer description: HTTP status code details: type: object additionalProperties: true description: Additional context about the error meta: type: object properties: request_id: type: string timestamp: type: string format: date-time docs_url: type: string format: uri description: Link to relevant error documentation RateLimitedResponse: description: >- Rate limit exceeded. Wait `error.retry_after` seconds (or read the `Retry-After` header) before retrying. Returned when the request would exceed the bucket identified by `X-RateLimit-Bucket`. headers: X-RateLimit-Limit: description: Total request quota for the current window. schema: type: integer minimum: 0 X-RateLimit-Remaining: description: Requests remaining in the current window. schema: type: integer minimum: 0 X-RateLimit-Reset: description: >- Absolute unix-epoch-seconds timestamp at which the current window resets. schema: type: integer minimum: 0 X-RateLimit-Bucket: description: >- Name of the rate-limit bucket the request was bound by (e.g. `auth-write`, `money`, `agent-invoke`, or `custom:/`). Stripe-style — lets clients see which named cap they hit. schema: type: string RateLimit-Limit: description: >- draft-ietf-httpapi-ratelimit-headers no-prefix mirror of `X-RateLimit-Limit`. Some SDKs read only this form. schema: type: integer minimum: 0 RateLimit-Remaining: description: >- draft-ietf-httpapi-ratelimit-headers no-prefix mirror of `X-RateLimit-Remaining`. schema: type: integer minimum: 0 RateLimit-Reset: description: >- draft-ietf-httpapi-ratelimit-headers no-prefix mirror — delta seconds from now until the window resets (NOT epoch). schema: type: integer minimum: 0 Retry-After: description: >- RFC 7231 §7.1.3 — number of seconds the client should wait before retrying. schema: type: integer minimum: 1 content: application/json: schema: type: object properties: error: type: object required: - code - message - status - retry_after properties: code: type: string enum: - RATE_LIMITED description: >- Always `RATE_LIMITED` — the global request-limiter 429. Distinct from `RATE_LIMIT_EXCEEDED`, the live per-recipient/per-tenant/per-resource frequency-cap 429 (not retired). message: type: string status: type: integer enum: - 429 retry_after: type: integer minimum: 1 description: >- Seconds to wait before retrying. Mirrors `Retry-After` header. meta: type: object properties: request_id: type: string timestamp: type: string format: date-time docs_url: type: string format: uri securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````