Revoke a restaurant key
Partner key + restaurant key. Revokes a restaurant key now (graceHours: 0, the default) or after up to 24 hours. The body is optional.
The key you are calling with (in X-LettBestilt-Restaurant-Key) cannot be revoked immediately (409 KEY_IN_USE); rotate it instead, or pass graceHours. Allowed for an archived restaurant too: access can always be removed.
Authentication
The partner key, sent as Authorization: Bearer lbp_test_…. Created in the partner portal under Partner key. It belongs to the partner, not to a restaurant, and only works against /api/v1/partner. Server to server only: a request with an Origin header is rejected with 403 FORBIDDEN. A test key sees and creates only sandboxes; live partner keys are not available yet. A revoked key, a restaurant key (lbs_…) here, or a suspended or archived partner returns 401 UNAUTHORIZED; an expired key returns 401 KEY_EXPIRED.
The restaurant’s own key (lbs_test_… or lbs_live_…), sent in X-LettBestilt-Restaurant-Key together with the partner key for calls about one restaurant. The key must have full access (scope *, otherwise 403 INSUFFICIENT_SCOPE), belong to a restaurant the partner owns, and be in the same environment as the partner key (otherwise 401 UNAUTHORIZED). A slug that does not exist, belongs to another partner or does not match the key always gives the same 404 RESTAURANT_NOT_FOUND. Older keys without an environment in the prefix (lbs_<random>) are not accepted here; rotate them in the partner portal.
Path parameters
The key’s id, from apiKeys in GET /partner/restaurants/{slug}.
Request
Hours until the key stops working, 0–24. Defaults to 0 (now).
Response
Revoked, or scheduled. revokedAt is when the key stops working.