> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # Revoke legacy team API and MCP credentials > Requires a verified Firebase or personal MCP user credential and current team administrator/owner or billing-account administrator authority. A team API key or OAuth token cannot act as its creator. Select the team with the team query parameter. For v2 plans, issuance requires apiAndWebhooks; legacy issuance behavior is preserved. Metadata and revocation remain available after a downgrade. Revokes active legacy API and personal MCP credentials associated with the selected team, potentially including the calling legacy token. Named scoped keys, malformed scoped-marker records and OAuth credentials are untouched. The historical team_api_and_mcp_keys result label describes this legacy operation only. Batched revocation resumes its durable fence after interruption. ## OpenAPI ````yaml openapi.json POST /api-keys/emergency-revoke openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Internal partner provisioning is outside this public contract; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /api-keys/emergency-revoke: post: tags: - API Credentials summary: Revoke legacy team API and MCP credentials description: >- Requires a verified Firebase or personal MCP user credential and current team administrator/owner or billing-account administrator authority. A team API key or OAuth token cannot act as its creator. Select the team with the team query parameter. For v2 plans, issuance requires apiAndWebhooks; legacy issuance behavior is preserved. Metadata and revocation remain available after a downgrade. Revokes active legacy API and personal MCP credentials associated with the selected team, potentially including the calling legacy token. Named scoped keys, malformed scoped-marker records and OAuth credentials are untouched. The historical team_api_and_mcp_keys result label describes this legacy operation only. Batched revocation resumes its durable fence after interruption. operationId: emergencyRevokeApiCredentials parameters: - $ref: '#/components/parameters/TeamParameter' requestBody: required: false content: application/json: schema: type: object additionalProperties: false properties: {} responses: '200': description: Credential lifecycle result. Responses are not cacheable. content: application/json: schema: type: object properties: success: type: boolean data: type: object properties: revoked_count: type: number scope: type: string enum: - team_api_and_mcp_keys oauth_revoked: type: boolean enum: - false required: - revoked_count - scope - oauth_revoked timestamp: type: number required: - success - data - timestamp '400': description: Invalid body, team, filter or pagination. '401': description: Verified user credential required. '403': description: Current account authority or issuance entitlement required. '404': description: Credential or team not found in the authorized scope. '409': description: >- Active keys already exist, concurrent keys_changed conflict, or revocation in progress. '500': description: >- Credential operation failed; reconcile metadata before retrying. No signer details are returned. security: - bearerAuth: [] components: parameters: TeamParameter: name: team in: query required: false schema: type: string description: > **gigstack Connect:** Target team ID for multi-team access. Requires gigstack Connect enabled on your team and shared billing account. Also requires the `multipleIssuerAccounts` feature on your plan. Requests targeting a team other than the one your API key belongs to return `403` without it. Only API keys can use it: an OAuth access token sent with another team's id is rejected with `403 Team mismatch with OAuth token`. **Optional — omit it entirely** unless you are acting on another team. It deliberately carries no example value so generated snippets do not emit `?team=undefined`; when the parameter is absent, the team is derived from your API key. **Example:** `?team=team_xyz789` securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": … }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.