Skip to main content
POST
Revoke API key
The response body shown here is a static example, not live data. After you click Send, your live result appears in a separate panel headed 200 OK. The panel under the status-code tabs is a fixed sample from the spec — its field values (fees, prices, sizes, IDs, timestamps) are placeholders. Use Send, or call the endpoint, for current values.
Revoke (remove) an existing API key. The request is authenticated by a secp256k1 EIP-712 typed-data signature produced with the wallet that owns address (the same wallet that originally signed the matching createApiKey). The gateway recovers the signer and rejects mismatches with HTTP 401. This endpoint does not require an X-API-Key header so the owner can still revoke a key that has been lost or compromised. Revocation is scoped to (address, publicKey): only the account that owns the key may revoke it. A revoke for a key not registered to the caller’s account returns HTTP 404 and is a no-op — no state is changed.

Signing the request

Identical to createApiKey — same Arcus API Key domain, same per-environment chainId values, no verifyingContract — except the primary type is RevokeApiKey and the message does not include validUntil (revoke applies regardless of the key’s remaining lifetime). Domain
Types
Message
Complete eth_signTypedData_v4 call (ethers v6 / viem)
Revokes signed by any wallet other than the original creator are rejected.

Legacy EIP-191 signatures (deprecated)

This endpoint previously accepted an EIP-191 personal_sign signature over the canonical JSON message
(keys in this exact order, no whitespace, no trailing newline). During the migration window the server accepts either scheme: it verifies the EIP-712 signature first and falls back to legacy EIP-191. EIP-191 is deprecated and will be rejected once the migration window closes — migrate existing integrations to EIP-712 typed data; new integrations must use EIP-712 only.

Body

application/json
address
string
required

Ethereum address that owns the API key to revoke.

Pattern: ^(0x|0X)?[0-9a-fA-F]{40}$
Example:

"0x742d35cc6634c0532925a3b844bc9e7595f2bd18"

publicKey
string
required

Hex-encoded Ed25519 public key that identifies the API key to revoke.

Required string length: 64
Pattern: ^[0-9a-fA-F]{64}$
Example:

"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"

apiWalletName
string
required

Name of the API wallet (included in the signing message, must match createAPIKey).

Required string length: 1 - 64
Example:

"Arcus"

signature
object
required

secp256k1 EIP-712 typed-data signature (r, s, v) over the RevokeApiKey payload (eth_signTypedData_v4), produced by the wallet that owns address — must be the same wallet that originally signed the matching createApiKey. See the POST /v1/revokeApiKey endpoint description for the exact domain, types, and message. During the migration window the deprecated legacy EIP-191 personal_sign scheme is also accepted. Requests where the recovered signer does not equal address are rejected with HTTP 401.

Response

API key revocation accepted and dispatched to the matching engine.

apiKey
string
required

API key (hex string) that was revoked.

address
string
required

20-byte EVM address as hex: optional 0x or 0X prefix and exactly 40 hexadecimal digits. API responses normalize to lowercase af after 0x.

Pattern: ^(0x|0X)?[0-9a-fA-F]{40}$
revokedAt
integer<int64>
required

Revocation timestamp (epoch microseconds).

accountIndex
integer

Account index for this API key.

Required range: 0 <= x <= 9