apikey.deleted

Sent when an API key is revoked from the dashboard’s API Key tab (or DELETE /v1/api-keys/{id}).

Tip

Revoking an already-revoked key is a no-op — it doesn’t send a second apikey.deleted. Retrying a delete call you’re not sure succeeded is safe.

Headers

Header	Description
X-Baiyar-Signature	t=<unix timestamp>,v1=<hex HMAC-SHA256> — see Verifying Webhook Signatures
Content-Type	application/json

Payload

{
  "id": "evt_XkNRVOTeE68pQz2AinL9",
  "type": "apikey.deleted",
  "created_at": "2026-09-16T04:03:46Z",
  "data": {
    "id": "01a0a63d-3db6-73fa-ab21-5861a54024e4",
    "name": "Webhook verification key",
    "environment": "sandbox",
    "project_id": "project_IChAi2NR4vzKN3SgEYPI",
    "key_prefix": "sk_test_",
    "revoked_at": "2026-09-16T04:03:46Z"
  }
}

Field	Type	Description
id	string	Unique event ID — use it to deduplicate retried deliveries, not data.id
type	string	Always apikey.deleted
created_at	date-time	When the event was generated
data.id	string	The API key’s ID
data.environment	string	sandbox or production
data.project_id	string	The project’s public ID
data.key_prefix	string	sk_test_ or sk_live_
data.revoked_at	date-time	When the key was revoked

The key stops authenticating requests immediately — this event just notifies you it happened, it isn’t what causes it.

Testing

There’s no sandbox simulator for this event — trigger it by actually revoking a sandbox API key from the dashboard and watching your endpoint receive the delivery within a few seconds.