---
type: api
title: Invalidate API keys
description: This API invalidates API keys created by the create API key or grant API key APIs.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/operation/operation-security-invalidate-api-key
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/operation/operation-security-invalidate-api-key
products:
  - Elasticsearch Serverless
---

# Invalidate API keys

Availability:

## Paths

- `DELETE` `/_security/api_key`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/authentication#apikeyauth)

## Description

This API invalidates API keys created by the create API key or grant API key APIs.
Invalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted.

To use this API, you must have at least the `manage_security`, `manage_api_key`, or `manage_own_api_key` cluster privileges.
The `manage_security` privilege allows deleting any API key, including both REST and cross cluster API keys.
The `manage_api_key` privilege allows deleting any REST API key, but not cross cluster API keys.
The `manage_own_api_key` only allows deleting REST API keys that are owned by the user.
In addition, with the `manage_own_api_key` privilege, an invalidation request must be issued in one of the three formats:

- Set the parameter `owner=true`.
- Or, set both `username` and `realm_name` to match the user's identity.
- Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the `ids` field.

## Required authorization

* Cluster privileges: `manage_api_key`,`manage_own_api_key`

## Request Body

`application/json`

- `id` (string Id) — optional
- `ids` ([] string Id) — optional
  A list of API key ids.
This parameter cannot be used with any of `name`, `realm_name`, or `username`.
- `name` (string Name) — optional
  An API key name.
This parameter cannot be used with any of `ids`, `realm_name` or `username`.
- `owner` (boolean · default: false) — optional
  Query API keys owned by the currently authenticated user.
The `realm_name` or `username` parameters cannot be specified when this parameter is set to `true` as they are assumed to be the currently authenticated ones.

NOTE: At least one of `ids`, `name`, `username`, and `realm_name` must be specified if `owner` is `false`.
- `realm_name` (string) — optional
  The name of an authentication realm.
This parameter cannot be used with either `ids` or `name`, or when `owner` flag is set to `true`.
- `username` (string) — optional
  The username of a user.
This parameter cannot be used with either `ids` or `name` or when `owner` flag is set to `true`.

## Response

`application/json`

- `error_count` (number)
  The number of errors that were encountered when invalidating the API keys.
- `error_details` ([] ErrorCause)
  Details about the errors.
This field is not present in the response when `error_count` is `0`.
  - `type` (string)
    The type of error
  - `reason` (union string) — nullable
    A human-readable explanation of the error, in English.
    One of: `string`
  - `stack_trace` (string)
    The server stack trace. Present only if the `error_trace=true` parameter was sent with the request.
  - `caused_by` ({} ErrorCause) — recursive
    Same fields as `error_details`
  - `root_cause` ([] ErrorCause) — recursive
    Same fields as `error_details`
  - `suppressed` ([] ErrorCause) — recursive
    Same fields as `error_details`
- `invalidated_api_keys` ([] string)
  The IDs of the API keys that were invalidated as part of this request.
- `previously_invalidated_api_keys` ([] string)
  The IDs of the API keys that were already invalidated.
## Code Examples

#### Console

```console
DELETE /_security/api_key
{
  "ids" : [ "VuaCfGcBCdbkQm-e5aOx" ]
}
```

#### JavaScript

```javascript
const response = await client.security.invalidateApiKey({
  ids: ["VuaCfGcBCdbkQm-e5aOx"],
});
```

#### Python

```python
resp = client.security.invalidate_api_key(
    ids=[
        "VuaCfGcBCdbkQm-e5aOx"
    ],
)
```

#### curl

```curl
curl -X DELETE "$ELASTICSEARCH_URL/_security/api_key" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "VuaCfGcBCdbkQm-e5aOx"
    ]
  }'
```

#### Java

```java
client.security().invalidateApiKey(i -> i
    .ids("VuaCfGcBCdbkQm-e5aOx")
);
```

#### C#

```c#
var response = await client.Security
    .InvalidateApiKeyAsync(d1 => d1
        .Ids(["VuaCfGcBCdbkQm-e5aOx"])
    );
```

#### PHP

```php
$resp = $client->security()->invalidateApiKey([
    "body" => [
        "ids" => array(
            "VuaCfGcBCdbkQm-e5aOx",
        ),
    ],
]);
```

#### Ruby

```ruby
response = client.security.invalidate_api_key(
  body: {
    "ids": [
      "VuaCfGcBCdbkQm-e5aOx"
    ]
  }
)
```

## Response Examples

#### Security invalidate api key response example1

A successful response from `DELETE /_security/api_key`.

```json
{
  "invalidated_api_keys": [ 
    "api-key-id-1"
  ],
  "previously_invalidated_api_keys": [ 
    "api-key-id-2",
    "api-key-id-3"
  ],
  "error_count": 2, 
  "error_details": [ 
    {
      "type": "exception",
      "reason": "error occurred while invalidating api keys",
      "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "invalid api key id"
      }
    },
    {
      "type": "exception",
      "reason": "error occurred while invalidating api keys",
      "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "invalid api key id"
      }
    }
  ]
}
```