Skip to content

Delete MCP API Key

Method

REST method is adopted.

HTTP Method

DELETE: Delete MCP API key (soft delete)

Naming Convention

To unify the naming of query parameters and nodes and improve readability, snake_case is used for URIs and JSON nodes in requests.

Request and Response

Headers

Meta information is set in HTTP headers, not in the response body.

Request Headers

  • Authorization
  • Content-Type
  • Accept
  • Accept-language

Response Headers

  • Content-Type

Delete MCP API Key

URI

DELETE /v1/organizations/{organization_id}/projects/{project_id}/mcp_api_key/{mcp_api_key_id}

Path Parameters

Name Type Required Description
organization_id integer Required Organization ID
project_id integer Required Project ID
mcp_api_key_id integer Required MCP API key ID

Response

The response is JSON.

{
  "id": 1,
  "userId": 1,
  "projectId": 2,
  "name": "mcp for project A",
  "keyPrefix": "abc123",
  "permission": 0,
  "expiresAt": 1735689600000,
  "revokedAt": null,
  "lastUsedAt": 1234567890000,
  "createdAt": 1234567890000,
  "updatedAt": 1234567899999,
  "deletedAt": 1234567899999,
  "createdBy": "user-cognito-sub",
  "updatedBy": "user-cognito-sub",
  "deletedBy": "deleter-cognito-sub"
}

Response Fields

Name Type Description
id integer MCP API key ID
userId integer | null User ID (when scope is user)
projectId integer | null Project ID (when scope is project)
name string API key name
keyPrefix string Key prefix
permission integer Access permission (0: READ, 1: WRITE)
expiresAt number | null Expiry timestamp (epoch milliseconds)
revokedAt number | null Revocation timestamp (epoch milliseconds)
lastUsedAt number | null Last used timestamp (epoch milliseconds)
createdAt number Creation timestamp (epoch milliseconds)
updatedAt number Update timestamp (epoch milliseconds)
deletedAt number Deletion timestamp (epoch milliseconds)
deletedBy string Cognito sub of the user who deleted the key

Authentication

Authentication is performed using JSON Web Tokens (JWT) issued by Amazon Cognito.

Error Handling

The status codes for error handling are as follows.

Description Status Code Status Name
Missing credentials 401 Unauthorized
Insufficient permissions 403 Forbidden
MCP API key not found 404 Not Found
Internal server error 500 Internal Server Error

Processing Flow

  1. Extract organization ID, project ID, and MCP API key ID from path parameters
  2. Verify the user has access to the project
  3. Verify the key exists
  4. Verify the key is associated with the specified project
  5. Verify the user has permission to delete the key
  6. Perform soft delete (set deletedAt and deletedBy)
  7. Set the updated timestamp
  8. Return the deleted key information

Soft Delete

  • A timestamp is set in the deletedAt field rather than performing a physical deletion
  • Deleted keys are excluded from normal queries
  • Deleter information is recorded in the deletedBy field

Notes

This endpoint performs a soft delete. The record is not physically removed from the database; the deletedAt and deletedBy fields are set instead.

Detailed Flowchart

flowchart TD
    Start([DELETE Request]) --> Auth[Auth & Parameter Extraction]
    Auth --> Service[Service Layer]
    Service --> AccessCheck[Access Check]
    AccessCheck --> HasAccess{Write permission?}
    HasAccess -->|No| Err404[404 Not Found]
    HasAccess -->|Yes| CheckExist[Check Existence]
    CheckExist --> Exists{Exists?}
    Exists -->|No| Err404
    Exists -->|Yes| SoftDelete[Soft Delete<br/>Set deletedAt]
    SoftDelete --> Success[200 OK]