Revoke an API key

DESTRUCTIVE. Revoke a sub-account API key by deleting it. Integrations using it stop working immediately.

DELETE https://api.centerfy.ai/webhooks/inbound/agency/sub-accounts/:id/api-keys/:keyId

Headers

Header	Required	Value	Description
`x-api-key`	Yes	your agency API key (cfy_…)	Agency (organization-wide) API key, created in the agency workspace under Settings → API Keys (“Agency API Keys”; the tab only appears on White Label or SaaS Mode plans). Or send Authorization: Bearer `<key>`; x-api-key wins if both are present. Keys must start with cfy_. A sub-account key is rejected with 401.

Path parameters

Name	Type	Required	Description
`id`	`string (uuid)`	Yes	The sub-account id. Must belong to the key’s agency and not be deleted.
`keyId`	`string (uuid)`	Yes	The API key id (id from List API keys).

Example

curl -X DELETE "https://api.centerfy.ai/webhooks/inbound/agency/sub-accounts/{id}/api-keys/{keyId}" \
  -H "x-api-key: $CENTERFY_AGENCY_API_KEY"

import { CenterfyAgencyClient } from "@centerfy/sdk";

const agency = new CenterfyAgencyClient({ apiKey: process.env.CENTERFY_AGENCY_API_KEY! });

const result = await agency.subAccountApiKeys.revoke("<subAccountId>", "<keyId>");
console.log(result);

centerfy --agency subAccountApiKeys revoke <subAccountId> <keyId>

MCP tool: centerfy_agency_sub_account_api_keys_revoke (see MCP server)

Response

{
  "status": "success",
  "revoked": true,
  "api_key_id": "b07f9284-e1a3-44c5-b061-7c8d9eafb007"
}

Errors

404 — if keyId is not a key of this sub-account.
404 — when the sub-account id is not a uuid, does not exist, is deleted, or belongs to another agency.
401 — when the key is missing, not cfy_-prefixed or unknown (including sub-account keys); 403 when the agency is not on a White Label or SaaS Mode plan; 429 above 50 requests per minute per agency (Retry-After header set); 500 ‘database error’ on an internal failure.

Notes

There is no revoked state — the key row is deleted and can’t be restored.