# Revoke an Approval Key

For good: decisions signed with it are refused from now on.

## Overview

- One of your own keys. The body is optional: `reason`, 1 to 500 characters, kept as `revokeReason`.
- `200` with the key, `status` `revoked` and `revokedAt`. It stays listed and never changes again; the decisions it signed before stand. A decision it signs from now on answers `403` `APPROVAL_SIGNATURE_KEY_UNKNOWN`.
- To rotate: [register](https://docs.aureahub.com/docs/approval-key-register.md) the new key first, then revoke the old one.
- `404` `APPROVAL_KEY_NOT_FOUND` (`No such approval key of yours`) for a key that is not yours; `409` `APPROVAL_KEY_REVOKED` (`This key is revoked already`). Written to your tenant's audit trail (`approval_key.revoked`) [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md).

## Endpoint

### `POST /v1/approval-keys/{keyId}/revoke`

Authentication: bearer token required.

Revokes one of your approval keys, for good.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `keyId` | string (uuid) | yes | The key's id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `reason` | string | no | 1–500 characters |

**Responses**

`200` Revoked

```json
{
  "id": "7b2e4c91-5d3a-4f68-8e0b-1c9a7d3f5e24",
  "name": "Laptop key",
  "status": "revoked",
  "publicKey": {
    "kty": "EC",
    "crv": "P-256",
    "x": "oxctA6E_hib_b2IU2itzKLJ2wIh5f89eC4F5_-8jreA",
    "y": "HXPIR2nV0i74GXLTQpg6rHEbZ67c_D1xaJUIccZCrjg"
  },
  "thumbprint": "CFGfOpgdwqX6UnGU5dwiwVwsk9edRucCD8GDfAr9xrI",
  "createdAt": "2026-10-06T09:12:40.511Z",
  "lastUsedAt": "2026-10-06T12:20:03.511Z",
  "revokedAt": "2026-11-02T08:30:00.000Z",
  "revokeReason": "Laptop replaced"
}
```

`404` Not yours

```json
{
  "statusCode": 404,
  "error": "NotFoundError",
  "message": "No such approval key of yours",
  "details": { "code": "APPROVAL_KEY_NOT_FOUND" }
}
```

---

Web version: https://docs.aureahub.com/#approval-key-revoke