Revocation

Revoking a key makes it permanently unusable. It is the action to take after a leak, when a supplier leaves, or at the end of a rotation.

Revoking a key

On the API keys page of Platform, click Revoke next to the key. Platform confirms that the key no longer authenticates anything. If the key was already revoked, it says so. Any member of the organisation can revoke the keys of its workspaces, and every revocation is logged by Noryo.

What a call with that key sees next

From the next request, the key is refused:

{
  "type": "https://developer.noryo.app/errors/invalid_api_key",
  "title": "Invalid API credential",
  "status": 401,
  "code": "invalid_api_key",
  "detail": "The API credential is missing, malformed, revoked, or unknown.",
  "request_id": "req_…"
}

• The code is the same as for an unknown key: the response does not reveal that a key existed.
• The refusal happens before the rate-limit check and before the engine: nothing is computed, nothing is billed, no token is consumed.
• A revoked key cannot be used to read, replay or refresh, including the results it created.

What survives

What does not exist

• No reactivation. Platform offers no way to make a revoked key valid again: create a new one.
• No revocation through the API. Revocation happens in Platform; no Noryo Merchant API route manages keys.
• No grace period. The key stops working entirely once revoked.

Revocation versus account deactivation

A revoked key returns 401 invalid_api_key. An intact key whose organisation or workspace is no longer active returns 403 account_inactive: this is not a revocation, and creating a new key does not change it. See account_inactive.