Skip to content
Sursa Developers

Events · People and access

api_key.revoked

API key revoked

An API key was revoked and stops working.

Object type
api_key
Delivered to
Endpoints with the admin role

Payload

Object: EventApiKeyRevoked

  • idstringrequired

    Event ID (evt_…), also sent as the webhook-id header. Use it to drop duplicate deliveries.

  • typestringrequired

    Allowed values: api_key.revoked

  • created_atstring (date-time)required

    When the change happened (UTC).

  • org_idintegerrequired
  • api_versionstringrequired

    Contract version of the data schema.

  • sequenceinteger

    Delivery sequence number within the endpoint (absent for a test event).

  • objectWebhookEventObjectrequired
  • payloadstringrequired

    thin means no data: read the object through the API.

    Allowed values: fullthin

  • dataobject
    Fields
    • api_keyEventAPIKeyrequired
    • actor_idinteger | nullrequired

      The user who performed the action; null for an organization API key or the platform itself.

    • reasonstring

      Why it was revoked: manual or user_offboarded.

  • testbooleanrequired

    A test event sent by POST /v1/webhooks/{webhook_id}/test.

Example delivery

{
  "id": "evt_0123456789abcdef0123456789abcdef",
  "type": "api_key.revoked",
  "created_at": "2026-10-24T10:00:03Z",
  "org_id": 1,
  "api_version": "1.62.0",
  "sequence": 1042,
  "object": {
    "type": "api_key",
    "id": "14"
  },
  "payload": "full",
  "data": {
    "api_key": {
      "id": 14,
      "name": "CRM sync",
      "prefix": "kb_3f9a",
      "kind": "org",
      "role": "editor",
      "scopes": [
        "cards:read",
        "cards:write"
      ],
      "expires_at": "2026-10-31T00:00:00Z"
    },
    "actor_id": 7,
    "reason": "manual"
  },
  "test": false
}

Receiving events

Each delivery is a POST request with this JSON body to your endpoint. Verify the webhook-signature header (Standard Webhooks) before you trust the body, answer with a 2xx status within a few seconds, and do the work afterwards. Deliveries to one endpoint keep the order of events; a failed delivery is retried with growing pauses.

New event types and new fields can appear at any time: skip the types and fields you do not know.

The same events are in the event feed for 30 days →