Delete an Organization API Key

DELETE /organization-pats/{id}

Delete Pat

cURL

curl --request DELETE \
  --url https://api.example.com/organization-pats/{id} \
  --header 'Authorization: Bearer <token>'

200

{
  "message": "<string>"
}

Deleting the local pats row is what actually revokes the key: the exchange looks the key up there on every request, so a deleted row means an immediate 401 for anything still using it.

Row-level security scopes the lookup to the caller’s active organization, so an id from a different org behaves exactly like an unknown one — 404, never a 403 that would confirm the row exists elsewhere. The paired Logto-side personal access token is deleted first, addressed by the key’s owner rather than the caller, so an admin revoking someone else’s key cleans up the right upstream token instead of orphaning it. A Logto-side 404 — already gone, nothing left to orphan — is tolerated and logged, and the local row is still deleted.

Auth

Requires pats:delete and an active organization.

By default you can only delete your own keys: the lookup is filtered on the caller’s user_id, so another member’s id returns the same 404 as an unknown one and gives you no way to enumerate keys you don’t own. Row-level security alone does not cover this — it enforces only the organization boundary.

A caller holding organizations:manage (the admin role) may delete any key in the organization, so a departed member’s integration key stays revokable. Admin revocations of someone else’s key are logged with both user ids.

Response

200

{ "message": "PAT deleted successfully" }

Errors

Status	Cause
404 Not Found	No key with this id in the caller’s organization — or, without organizations:manage, a key in it that belongs to another member.
Logto’s own status, verbatim	Deleting the paired token from Logto failed for a reason other than “already gone.” Logto’s status code is re-raised as-is with a generic Failed to delete token from identity provider. detail — so a Logto 403 surfaces to you as a 403, which is easy to misread as your token lacking permission.
500 Internal Server Error	Logto was unreachable (transport-level failure — connection refused, DNS, timeout).

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

id · string · required

The organization API key's id.

Response

200

application/json

Successful Response

message · string · required