# Revoke a child key

URL: https://docs.healthcare.dev/reference/keys/revoke-a-child-key

```http
DELETE https://api.healthcare.dev/v1/keys/{id}
```

Revoke a child key: it stops working within 30 seconds and can't be restored. Revoking twice is harmless. Works on every plan.

Requires an API key: `Authorization: Bearer hdev_live_...`. See [Authentication](/authentication).

## Path parameters

| Name | Type | Required | Description | Example |
| --- | --- | --- | --- | --- |
| `id` | string (uuid) | yes | The child key's id | `3f1c9a52-6b0e-4d7a-9c2e-8a4b7d1e0f63` |

## Examples

**curl**

```sh
curl -X DELETE "https://api.healthcare.dev/v1/keys/3f1c9a52-6b0e-4d7a-9c2e-8a4b7d1e0f63" \
  -H "Authorization: Bearer $HDEV_API_KEY"
```

**TypeScript**

```ts
const res = await fetch("https://api.healthcare.dev/v1/keys/3f1c9a52-6b0e-4d7a-9c2e-8a4b7d1e0f63", {
  method: "DELETE",
  headers: { Authorization: `Bearer ${process.env.HDEV_API_KEY}` },
});
const { data, meta } = await res.json();
```

**Python**

```python
import os
import requests

res = requests.delete("https://api.healthcare.dev/v1/keys/3f1c9a52-6b0e-4d7a-9c2e-8a4b7d1e0f63", headers={"Authorization": f"Bearer {os.environ['HDEV_API_KEY']}"})
body = res.json()
```

## Response

The revoked child key

```json
{
  "data": {
    "id": "string",
    "name": "string",
    "prefix": "string",
    "env": "live",
    "scopes": [
      "codes"
    ],
    "rps_limit": 1,
    "monthly_cap_cents": 1,
    "month_to_date": {
      "calls": 1,
      "spend_cents": 1
    },
    "created_at": "string",
    "last_used_at": "string",
    "revoked_at": "string"
  },
  "meta": {
    "source": "cms-icd10",
    "data_version": "2026.1",
    "retrieved_at": "2026-10-24T12:00:00Z",
    "license": "Public domain (CMS). Reference data, not medical advice."
  },
  "links": {
    "self": "/v1/keys/3f1c9a52-6b0e-4d7a-9c2e-8a4b7d1e0f63",
    "next": null
  }
}
```

### Fields

| Field | Type | Always present | Description |
| --- | --- | --- | --- |
| `id` | string | yes |  |
| `name` | string | yes |  |
| `prefix` | string | yes | The key's public prefix (`hdev_live_k3j9x2ab`), never the secret |
| `env` | "live" \| "test" | yes |  |
| `scopes` | KeyScope[] | yes | Route groups it may call; null for every group except `webhooks` |
| `rps_limit` | integer \| null | yes | Its own requests-a-second limit, if set |
| `monthly_cap_cents` | integer \| null | yes | Its monthly spend cap, if set |
| `month_to_date` | object | yes | Usage so far this month; it also counts toward the account's own usage |
| `created_at` | string | yes |  |
| `last_used_at` | string \| null | yes |  |
| `revoked_at` | string \| null | yes |  |

## Errors

Errors are `application/problem+json` ([RFC 9457](https://www.rfc-editor.org/rfc/rfc9457)). Branch on `type`, not on `title`. See [Errors](/errors).

| Status | `type` | When |
| --- | --- | --- |
| 401 | `unauthorized` | Missing, malformed or revoked API key. |
| 403 | `plan-upgrade-required` | The plan doesn't include this feature; `required_plan` names the plan that does. |
| 404 | `not-found` | No record with that id (retired records are still returned). |
| 429 | `rate-limited / quota-exceeded` | Too many requests per second (retry after `Retry-After`), or the monthly quota is used up. |