# Revocation

> Revoking a key in Platform, what a call with that key sees next, and what survives: results, idempotency, deduplication and history.

Revoking a key makes it permanently unusable. It is the action to take after a leak, when a supplier leaves, or at the end of a [rotation](https://developer.noryo.app/en-GB/merchant/authentication/rotation).

## Revoking a key

On the [API keys](https://platform.noryo.app/keys) page of Platform, click **Revoke** next to the key. Platform confirms that the key no longer authenticates anything. If the key was already revoked, it says so. Any member of the organisation can revoke the keys of its workspaces, and every revocation is logged by Noryo.

## What a call with that key sees next

From the next request, the key is refused:

```json
{
  "type": "https://developer.noryo.app/errors/invalid_api_key",
  "title": "Invalid API credential",
  "status": 401,
  "code": "invalid_api_key",
  "detail": "The API credential is missing, malformed, revoked, or unknown.",
  "request_id": "req_…"
}
```

- The code is the same as for an unknown key: the response does not reveal that a key existed.
- The refusal happens before the rate-limit check and before the engine: nothing is computed, nothing is billed, no token is consumed.
- A revoked key cannot be used to read, replay or refresh, including the results it created.

## What survives

| Item | After revocation |
|---|---|
| Results created with the key | Remain readable by the other keys of the same workspace and environment |
| Responses memorised under an `Idempotency-Key` | Remain replayable by another key of the workspace, within the 24-hour window |
| Deduplication by `external_transaction_id` | Unchanged |
| The key in the list | Stays listed, as revoked, with its history |
| Other keys of the workspace | Keep working |

## What does not exist

- **No reactivation.** Platform offers no way to make a revoked key valid again: create a new one.
- **No revocation through the API.** Revocation happens in Platform; no Noryo Merchant API route manages keys.
- **No grace period.** The key stops working entirely once revoked.

## Revocation versus account deactivation

A revoked key returns `401 invalid_api_key`. An intact key whose organisation or workspace is no longer active returns `403 account_inactive`: this is not a revocation, and creating a new key does not change it. See [account_inactive](https://developer.noryo.app/en-GB/errors/account_inactive).

---

Canonical page: https://developer.noryo.app/en-GB/merchant/authentication/revocation