---
canonical_url: "https://docs.composio.dev/reference/api-reference/api-keys/postApiKeyRevocation"
markdown_url: "https://docs.composio.dev/reference/api-reference/api-keys/postApiKeyRevocation.md"
product: "platform"
version: "3.1"
last_updated: null
---

# Revoke Composio API keys

**Documentation:** /reference/api-reference/api-keys/postApiKeyRevocation

> **API version:** This page documents Composio REST API v3.1, the current version, at `https://backend.composio.dev/api/v3.1`. `https://backend.composio.dev/api/v3` is the previous version and remains supported.

Public endpoint for reporting and revoking Composio API keys that have been leaked (e.g. via the GitHub Secret Scanning Partner Program, third-party scanners, or self-reported leaks). Accepts project (ak_*), user (uak_*), and org (oak_*) keys in a single batch. Matched keys are revoked and stop working immediately. The response shape is constant regardless of whether any submitted key matched, so callers cannot use this endpoint to probe key existence. The endpoint is rate limited; requests over the limit receive a 429.

---

## POST `/api/v3.1/api_key_revocation`

**Endpoint:** `https://backend.composio.dev/api/v3.1/api_key_revocation`

**Summary:** Revoke Composio API keys

Public endpoint for reporting and revoking Composio API keys that have been leaked (e.g. via the GitHub Secret Scanning Partner Program, third-party scanners, or self-reported leaks). Accepts project (ak_*), user (uak_*), and org (oak_*) keys in a single batch. Matched keys are revoked and stop working immediately. The response shape is constant regardless of whether any submitted key matched, so callers cannot use this endpoint to probe key existence. The endpoint is rate limited; requests over the limit receive a 429.

### Request Body

**Schema:**

- `api_keys` (array<string>) *(required)*: Composio API keys to revoke. Accepts project (ak_*), user (uak_*), and org (oak_*) keys. Each batch is capped at 100 entries.

**Example:**

```json
{
  "api_keys": [
    "string"
  ]
}
```

### Responses

#### 200 - Revocation request received

**Response Schema:**

- `received` (boolean) *(required)*: Always true when the request body is valid. The response intentionally does not reveal whether any submitted key matched a record.

**Example Response:**

```json
{
  "received": true
}
```

#### 400 - Malformed payload

**Response Schema:**

- `error` (object) *(required)*
  - `message` (string) *(required)*
  - `code` (number) *(required)*
  - `slug` (string) *(required)*
  - `status` (number) *(required)*
  - `request_id` (string)
  - `suggested_fix` (string)
  - `errors` (array<string>)

#### 429 - Too many requests

**Response Schema:**

- `error` (object) *(required)*
  - `message` (string) *(required)*
  - `code` (number) *(required)*
  - `slug` (string) *(required)*
  - `status` (number) *(required)*
  - `request_id` (string)
  - `suggested_fix` (string)
  - `errors` (array<string>)

#### 500 - Internal server error

**Response Schema:**

- `error` (object) *(required)*
  - `message` (string) *(required)*
  - `code` (number) *(required)*
  - `slug` (string) *(required)*
  - `status` (number) *(required)*
  - `request_id` (string)
  - `suggested_fix` (string)
  - `errors` (array<string>)

### Example cURL Request

```bash
curl -X POST "https://backend.composio.dev/api/v3.1/api_key_revocation" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "api_keys": [
      "string"
    ]
  }'
```

---

## REST API version

The current REST API version is **v3.1**, served at `https://backend.composio.dev/api/v3.1`. Prefer it for new code and new examples.

`https://backend.composio.dev/api/v3` is the previous version. It is frozen with pinned tool-version defaults and remains supported — existing v3 integrations keep working and do not need to migrate.