API keys

Revoke unused API keys

POST/v1/api-keys/revoke-unused

Revoke every key of one source that no request has used yet, such as the keys AI handoffs made for agents that never ran. A member limited to some brands revokes only their own keys.

curl -X POST "$AYEFORM_API/v1/api-keys/revoke-unused" \
  -H "Authorization: Bearer $AYEFORM_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "source": "handoff"
  }'

200 Response

[
  {
    "id": "cqxm1wn3vszzz7jsq5zxnjqbe3m6ngdx",
    "name": "Zapier",
    "prefix": "fk_live_…",
    "createdAt": 1790879400000,
    "lastUsedAt": 1790879400000,
    "revokedAt": null,
    "createdBy": "orders@luigispizza.com",
    "staff": false,
    "source": "handoff"
  }
]

Body

JSON, with Content-Type: application/json.

sourceenumrequired
Which keys: handoff for the keys AI handoffs made.
One of "handoff"
workspaceIdstring
Optional. Your API key already belongs to one workspace.

Response

A list of objects. The keys it revoked, with revokedAt set. Empty when there were none.

idstringrequired
The key's id. Use it to revoke the key.
namestringrequired
The name given when the key was made.
prefixstringrequired
The first 7 characters of the key, fk_ and 4 more, to tell keys apart. The key itself is never returned again.
createdAtnumberrequired
When the key was made, in milliseconds since the epoch.
lastUsedAtnumber or nullrequired
When a request last used the key, in milliseconds since the epoch. Null if it was never used.
revokedAtnumber or nullrequired
When the key was revoked, in milliseconds since the epoch. Null while the key works.
createdBystring or nullrequired
The user id of the member who made the key. A key made with another key gets that key's maker. Null when unknown.
staffbooleanrequired
True for a staff key, which may also call staff endpoints. False for every key you make.
sourceenum or nullrequired
What made the key: handoff when an AI handoff made it for its brief. Null for a key made by hand.

Errors answer with a status and the error shape.